fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
echo/modules/nickserv/src
History
Jean 61005f52f5
All checks were successful
CI / check (push) Successful in 3m46s
Details
services: throttle emailed codes to stop RESEND/RESETPASS email-bombing 
REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could
repeatedly request confirmation/reset codes for any account with an address
on file, flooding the victim's inbox and burning the service's sender
reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost
request throttle) now gates both paths; guessing was already infeasible
(2^40 code + 5-try limit), so this closes the abuse, not an auth hole.
2026-07-16 10:41:52 +00:00
..
ajoin.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
alist.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
cert.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
confirm.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
drop.rs ChanServ: add SET SUCCESSOR with founder inheritance 2026-07-15 18:58:08 +00:00
getemail.rs NickServ GETEMAIL + ChanServ SET RESTRICTED 2026-07-15 19:25:41 +00:00
ghost.rs NickServ: RECOVER regains your nick 2026-07-16 00:21:07 +00:00
glist.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
group.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
identify.rs MemoServ: add SET NOTIFY and SET LIMIT 2026-07-16 00:29:33 +00:00
info.rs NickServ: add SET HIDE STATUS for last-seen privacy 2026-07-16 02:33:55 +00:00
lib.rs NickServ: add SET HIDE STATUS for last-seen privacy 2026-07-16 02:33:55 +00:00
list.rs NickServ: add UPDATE and LIST 2026-07-15 18:24:52 +00:00
logout.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
noexpire.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
password.rs Group the module crates under modules/ 2026-07-14 14:19:43 +00:00
register.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
resetpass.rs services: throttle emailed codes to stop RESEND/RESETPASS email-bombing 2026-07-16 10:41:52 +00:00
saset.rs NickServ: add SASET for operator account edits 2026-07-16 00:45:18 +00:00
set.rs OperServ: enforce FORBID EMAIL at registration and SET EMAIL 2026-07-16 03:11:57 +00:00
suspend.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
ungroup.rs Rename the project to Echo (was fedserv) 2026-07-14 15:24:41 +00:00
update.rs NickServ: add UPDATE and LIST 2026-07-15 18:24:52 +00:00