Page MenuHomePhabricator
Create Task
Maniphest T232738

Add logging and throttling to PasswordReset workflow
Closed, InvalidPublic
Actions

Description

In T145952#5442469, @Reedy wrote:

Logging should be put in place so we can see the state of things (ip/user X requested reset for Y etc)... And we should be putting in a rate limiter to prevent one user/ip doing a loooad of requests

Related Objects

Event Timeline

Reedy created this task.Sep 12 2019, 12:46 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 12 2019, 12:46 PM
Reedy renamed this task from Add logging and throttling to Special:PasswordReset to Add logging and throttling to PasswordReset workflow.Sep 12 2019, 12:46 PM
Aklapper added projects: MediaWiki-User-login-and-signup, MediaWiki-Logevents.Sep 12 2019, 12:54 PM

Also see T19487: mail password per user rate limit should be global for SUL accounts and discussion in T181070: Re-evaluate 24-hour Password Reset email throttle.

Reedy closed this task as Invalid.Sep 17 2019, 2:56 PM

Apparently I'm blind.... Both logging and throttling are in the code (I blame looking at it when late and tired)

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits