Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): implement brute force rate limit for share passwords and improve UX with inline errors and visibility toggle
All checks were successful
Automated Container Build / build-and-push (push) Successful in 1m21s
Details

Browse source
This commit is contained in:
Elijah 2026-05-23 17:08:25 -07:00
parent 5262103a1a
commit 78ba0bf2d5
3 changed files with 65 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

13
backend/handlers/sharing.go
View file

@ -19,6 +19,7 @@ import (
type ShareHandler struct {
DB *database.DB
Config *config.Config
Guard *middleware.BruteForceGuard
}
type ShareRequest struct {
@ -197,8 +198,14 @@ func (h *ShareHandler) GetPublicShare(c *fiber.Ctx) error {
return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"require_password": true})
}
if !verifyPassword(req.Password, *hash) {
if h.Guard != nil {
h.Guard.RecordFailure(c.IP())
}
return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid password"})
}
if h.Guard != nil {
h.Guard.RecordSuccess(c.IP())
}
}
// Send file info
@ -273,8 +280,14 @@ func (h *ShareHandler) CreateShareToken(c *fiber.Ctx) error {
if hash != nil {
if req.Password == "" || !verifyPassword(req.Password, *hash) {
if h.Guard != nil {
h.Guard.RecordFailure(c.IP())
}
return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid password"})
}
if h.Guard != nil {
h.Guard.RecordSuccess(c.IP())
}
}
// Generate a short-lived download token with the share ID