lato 3.23.0 → 3.23.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 926e453e02a52408f23980d6ed7e0e74c40de3f4e5841a911420ea1b3df25128
-  data.tar.gz: 179a8b9e1959c8c734e92a17eec7c30e640da7f65df7b266e35f8f257d75094b
+  metadata.gz: 731f545c5ecf6168cae73f2ee10f5c2ba75cd81309e875797f7ea3a4e2e10511
+  data.tar.gz: 074c63ac0af5081662ee78b7ae54379208e8fc8e459ff4f4cb901d964f2bbf04
 SHA512:
-  metadata.gz: ed3a9f66a07bac72a2bba82dcfb2db645574b0c26e5860bccb72f21da54a14fc273554935408226365bcbc3b17b64b559298c7e32c4a3a0eae815271c0086c37
-  data.tar.gz: 02b9de09b5551dec982080c649f0e767faf3cb75c8c735fae962a30249095e3129ec7d2aa76cbdac8417931b1f1acea88f2a84691a492604aa81368610b9d5b8
+  metadata.gz: 99fd531e97c8bd89263351d4dbe953bcdb7e39dd6256219faca2e0e5dc480c64b0833b9f293fc71cb28de493bc262dce0bbd5474cf94dd9e44ffa2d6bd723a03
+  data.tar.gz: 68cf424eceb523273689aa3da4abb6d8096a3f4e0786efae77fe9e1b235a0ad7d31f0740a4acdfc92cd2ce4e3849405e1c7bca7897c83b37a7f7b9803a7d5ddd

data/app/models/lato/user.rb

@@ -240,6 +240,12 @@ module Lato
         return
       end
 
+      # Global cap checked before user lookup: the error is the same for every email, so it reveals nothing.
+      if recover_password_hourly_limit_reached?
+        errors.add(:base, :password_update_global_limit)
+        return
+      end
+
       user = Lato::User.find_by(email: email)
       return true unless user
 
@@ -252,6 +258,7 @@ module Lato
 
       # Async delivery keeps response time independent from email existence.
       Lato::UserMailer.password_update_mail(user.id, code).deliver_later
+      Rails.cache.increment(recover_password_hourly_cache_key, 1, expires_in: 1.hour)
 
       true
     end
@@ -451,6 +458,19 @@ module Lato
     # Cache
     ##
 
+    # Fixed hourly window shared by all users: stops mass mailing when an attacker knows many registered emails.
+    def recover_password_hourly_cache_key
+      "Lato::User/recover_password_hourly_count/#{Time.now.utc.strftime('%Y%m%d%H')}"
+    end
+
+    def recover_password_hourly_limit_reached?
+      limit = Lato.config.auth_recover_password_hourly_limit
+      return false if limit.nil?
+
+      # raw: true reads counters written by increment on stores that keep them unserialized (Redis, Memcache).
+      Rails.cache.read(recover_password_hourly_cache_key, raw: true).to_i >= limit
+    end
+
     def c_email_verification_semaphore(value = nil)
       cache_key = "Lato::User/c_email_verification_semaphore/#{id}"
       return Rails.cache.read(cache_key) if value.nil?

data/config/locales/en.yml

@@ -140,6 +140,7 @@ en:
               email_verification_code_invalid: Email verification code is invalid
               password_update_code_expired: Verification code has expired
               password_update_code_invalid: Verification code is invalid or expired
+              password_update_global_limit: Too many password recovery requests, please retry later
               credentials_not_correct: Email or password not correct
               privacy_policy_invalid: To accept the privacy policy you must select the confirmation checkbox
               terms_and_conditions_invalid: To accept the terms and conditions you must select the confirmation checkbox

data/config/locales/fr.yml

@@ -147,6 +147,7 @@ fr:
               email_verification_code_invalid: Le code de vérification de l'e-mail n'est pas valide
               password_update_code_expired: Le code de vérification a expiré
               password_update_code_invalid: Le code de vérification n'est pas valide ou a expiré
+              password_update_global_limit: Trop de demandes de récupération de mot de passe, veuillez réessayer plus tard
               credentials_not_correct: E-mail ou mot de passe incorrect
               privacy_policy_invalid: Pour accepter la politique de confidentialité, vous devez cocher la case de confirmation
               terms_and_conditions_invalid: Pour accepter les conditions générales, vous devez cocher la case de confirmation

data/config/locales/it.yml

@@ -147,6 +147,7 @@ it:
               email_verification_code_invalid: Il codice di verifica email non risulta valido
               password_update_code_expired: Il codice di verifica risulta scaduto
               password_update_code_invalid: Il codice di verifica non risulta valido o è scaduto
+              password_update_global_limit: Troppe richieste di recupero password, riprova più tardi
               credentials_not_correct: Email o password non corretti
               privacy_policy_invalid: Per accettare la privacy policy devi selezionare la checkbox di conferma
               terms_and_conditions_invalid: Per accettare i termini e condizioni devi selezionare la checkbox di conferma

data/config/locales/ro.yml

@@ -147,6 +147,7 @@ ro:
               email_verification_code_invalid: Codul de verificare email nu este valid
               password_update_code_expired: Codul de verificare a expirat
               password_update_code_invalid: Codul de verificare nu este valid sau a expirat
+              password_update_global_limit: Prea multe cereri de recuperare a parolei, încearcă din nou mai târziu
               credentials_not_correct: Email sau parolă incorectă
               privacy_policy_invalid: Pentru a accepta politica de confidențialitate trebuie să bifezi căsuța de confirmare
               terms_and_conditions_invalid: Pentru a accepta termenii și condițiile trebuie să bifezi căsuța de confirmare

data/lib/lato/config.rb

@@ -12,6 +12,9 @@ module Lato
     # Authentication configs
     attr_accessor :auth_disable_signup, :auth_disable_recover_password, :auth_disable_web3, :auth_disable_authenticator, :auth_disable_webauthn, :auth_disable_signin_success_mail
 
+    # Max password recovery emails sent per hour across all users (nil disables the cap)
+    attr_accessor :auth_recover_password_hourly_limit
+
     # Hcaptcha configs
     attr_accessor :hcaptcha_site_key, :hcaptcha_secret
 
@@ -49,6 +52,7 @@ module Lato
       @auth_disable_authenticator = false
       @auth_disable_webauthn = false
       @auth_disable_signin_success_mail = false
+      @auth_recover_password_hourly_limit = 100
 
       @hcaptcha_site_key = nil
       @hcaptcha_secret = nil

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.23.0"
+  VERSION = "3.23.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.23.0
+  version: 3.23.1
 platform: ruby
 authors:
 - Gregorio Galante