fedserv/echoIRCd
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

captcha: clamp recaptcha/cloudflare token TTL to [60s, 86400s] — an unclamped conf value could set exp in the past (every token instantly invalid, self-DoS) or absurdly far out

Browse source
This commit is contained in:
Jean Chevronnet 2026-08-19 01:18:13 +00:00
parent ee3c5e761e
commit 6f9d11f83e
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/modules/recaptcha.rs
View file

@ -60,7 +60,9 @@ fn port_whitelisted(s: &Server, uid: Uid) -> bool {
fn make_token(s: &Server, uid: Uid) -> Option<String> {
let secret = s.conf("recaptcha_secret")?;
let issuer = s.conf("recaptcha_issuer").unwrap_or("echoIRCd");
let ttl = s.conf_num("recaptcha_ttl", 1800i64);
// clamp to a sane positive window: a negative/absurd ttl would put exp in the
// past (instant self-DoS) or far future
let ttl = s.conf_num("recaptcha_ttl", 1800i64).clamp(60, 86400);
let ip = s.users.get(&uid)?.addr.ip().to_string();
let n = now() as i64;
let claims = format!(