Merge pull request #63830 from nextcloud/backport/63825/stable24

[stable24] fix(2fa): Add missing BruteForceProtection attribute

Author: artonge

core/Controller/TwoFactorChallengeController.php

@@ -184,6 +184,7 @@ public function showChallenge($challengeProviderId, $redirect_url) {
 	 * @TwoFactorSetUpDoneRequired
 	 *
 	 * @UserRateThrottle(limit=5, period=100)
+	 * @BruteForceProtection(action=solveChallenge)
 	 *
 	 * @param string $challengeProviderId
 	 * @param string $challenge
@@ -217,10 +218,12 @@ public function solveChallenge($challengeProviderId, $challenge, $redirect_url =
 		$uid = $user->getUID();
 		$this->logger->warning("Two-factor challenge failed: $uid (Remote IP: $ip)");
 		$this->session->set('two_factor_auth_error', true);
-		return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.showChallenge', [
+		$response = new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.showChallenge', [
 			'challengeProviderId' => $provider->getId(),
 			'redirect_url' => $redirect_url,
 		]));
+		$response->throttle(['user' => $uid, 'provider' => $challengeProviderId]);
+		return $response;
 	}
 
 	/**

tests/Core/Controller/TwoFactorChallengeControllerTest.php

@@ -268,6 +268,7 @@ public function testSolveChallengeInvalidProvider() {
 
 	public function testSolveInvalidChallenge() {
 		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('myuser');
 		$provider = $this->createMock(IProvider::class);
 
 		$this->userSession->expects($this->once())
@@ -297,11 +298,13 @@ public function testSolveInvalidChallenge() {
 			->willReturn('myprovider');
 
 		$expected = new RedirectResponse('files/index/url');
+		$expected->throttle(['user' => 'myuser', 'provider' => 'myprovider']);
 		$this->assertEquals($expected, $this->controller->solveChallenge('myprovider', 'token', '/url'));
 	}
 
 	public function testSolveChallengeTwoFactorException() {
 		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('myuser');
 		$provider = $this->createMock(IProvider::class);
 		$exception = new TwoFactorException("2FA failed");
 
@@ -335,6 +338,7 @@ public function testSolveChallengeTwoFactorException() {
 			->willReturn('myprovider');
 
 		$expected = new RedirectResponse('files/index/url');
+		$expected->throttle(['user' => 'myuser', 'provider' => 'myprovider']);
 		$this->assertEquals($expected, $this->controller->solveChallenge('myprovider', 'token', '/url'));
 	}