yuanbiao
/
emqx
1
0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #7787 from zmstone/0426-bad-password-penalty 

fix: add 2 seconds delay penalty for bad logins
This commit is contained in:
Zaiming (Stone) Shi 2022-04-27 10:33:43 +01:00 committed by GitHub
parent 0d43bd6243 4f45670725
commit c5329d7f60
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib-ce/emqx_dashboard/src/emqx_dashboard_admin.erl
View File

@ -183,13 +183,21 @@ check(Username, Password) ->
case lookup_user(Username) of case lookup_user(Username) of
[#mqtt_admin{password = PwdHash}] -> [#mqtt_admin{password = PwdHash}] ->
case is_valid_pwd(PwdHash, Password) of case is_valid_pwd(PwdHash, Password) of
true -> ok; true ->
false -> {error, <<"Username/Password error">>} ok;
false ->
ok = bad_login_penalty(),
{error, <<"Username/Password error">>}
end; end;
[] -> [] ->
ok = bad_login_penalty(),
{error, <<"Username/Password error">>} {error, <<"Username/Password error">>}
end. end.
bad_login_penalty() ->
timer:sleep(2000),
ok.
is_valid_pwd(<<Salt:4/binary, Hash/binary>>, Password) -> is_valid_pwd(<<Salt:4/binary, Hash/binary>>, Password) ->
Hash =:= md5_hash(Salt, Password). Hash =:= md5_hash(Salt, Password).