Jean
61005f52f5
All checks were successful
CI / check (push) Successful in 3m46s
REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could repeatedly request confirmation/reset codes for any account with an address on file, flooding the victim's inbox and burning the service's sender reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost request throttle) now gates both paths; guessing was already infeasible (2^40 code + 5-try limit), so this closes the abuse, not an auth hole. |
||
|---|---|---|
| .. | ||
| src | ||
| templates/email | ||
| Cargo.toml | ||