Skip to content

daemon(auth): address unsafe handling of repeated failed login attempts#638

Merged
bobheadxi merged 1 commit into
masterfrom
daemon/repeated-login
Mar 5, 2020
Merged

daemon(auth): address unsafe handling of repeated failed login attempts#638
bobheadxi merged 1 commit into
masterfrom
daemon/repeated-login

Conversation

@bobheadxi

Copy link
Copy Markdown
Member

🎟️ Ticket(s): n/a - potential vulnerability reported by @Luxi-Zhao and co.


👷 Changes

Removed the following behaviour outlined by @Luxi-Zhao 's report:

unsafe handling of repeated failed login attempts by deleting the account in question after 10 attempts

@bobheadxi bobheadxi added the pr: finalized needs review and final approval label Mar 5, 2020
@bobheadxi bobheadxi requested a review from a team March 5, 2020 05:36
@codecov

codecov Bot commented Mar 5, 2020

Copy link
Copy Markdown

Codecov Report

Merging #638 into master will decrease coverage by 0.12%.
The diff coverage is 50%.

Impacted file tree graph

@@            Coverage Diff            @@
##           master    #638      +/-   ##
=========================================
- Coverage   55.81%   55.7%   -0.11%     
=========================================
  Files          68      68              
  Lines        3385    3381       -4     
=========================================
- Hits         1889    1883       -6     
- Misses       1253    1254       +1     
- Partials      243     244       +1
Impacted Files Coverage Δ
daemon/inertiad/auth/users.go 72.25% <50%> (-1.34%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 729e2dc...18e5fda. Read the comment docs.

@bobheadxi bobheadxi merged commit d65708d into master Mar 5, 2020
@bobheadxi bobheadxi deleted the daemon/repeated-login branch March 5, 2020 06:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pr: finalized needs review and final approval

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant