fix(slave-controller): add brute force protection and avoid saving token on debug log

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>

fix(slave-controller): add brute force protection and avoid saving token on debug log

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>

Author: cristianscheid

lib/Controller/SlaveController.php

@@ -121,11 +121,9 @@ public function __construct($appName,
 	 * @PublicPage
 	 * @NoCSRFRequired
 	 * @UseSession
-	 *
-	 * @param string $jwt
-	 * @return RedirectResponse
+	 * @BruteForceProtection(action=autoLogin)
 	 */
-	public function autoLogin($jwt) {
+	public function autoLogin(string $jwt): RedirectResponse {
 
 		$masterUrl = $this->gss->getMasterUrl();
 
@@ -134,7 +132,9 @@ public function autoLogin($jwt) {
 		}
 
 		if ($jwt === '') {
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		}
 
 		try {
@@ -166,10 +166,14 @@ public function autoLogin($jwt) {
 
 		} catch (ExpiredException $e) {
 			$this->logger->info('token expired', ['app' => 'globalsiteselector']);
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		} catch (\Exception $e) {
 			$this->logger->logException($e, ['app' => 'globalsiteselector']);
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		}
 
 		$this->userSession->createSessionToken($this->request, $uid, $uid, null, IToken::REMEMBER);
@@ -179,17 +183,16 @@ public function autoLogin($jwt) {
 	}
 
 	/**
-	 * Create app token
-	 *
 	 * @PublicPage
 	 * @NoAdminRequired
-	 *
-	 * @return DataResponse
+	 * @BruteForceProtection(action=createAppToken)
 	 */
-	public function createAppToken($jwt) {
+	public function createAppToken($jwt): DataResponse {
 
 		if($this->gss->getMode() === 'master' || empty($jwt)) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+			$response = new DataResponse([], Http::STATUS_BAD_REQUEST);
+			$response->throttle();
+			return $response;
 		}
 
 		try {
@@ -217,7 +220,9 @@ public function createAppToken($jwt) {
 			$this->logger->logException('Create app password: ' . $e, ['app' => 'globalsiteselector']);
 		}
 
-		return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$response = new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$response->throttle();
+		return $response;
 
 	}