1
0

DatabaseBackend.php 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2023 Joas Schilling <coding@schilljs.com>
  5. * @copyright Copyright (c) 2021 Lukas Reschke <lukas@statuscode.ch>
  6. *
  7. * @author Joas Schilling <coding@schilljs.com>
  8. * @author Lukas Reschke <lukas@statuscode.ch>
  9. *
  10. * @license GNU AGPL version 3 or any later version
  11. *
  12. * This program is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License as
  14. * published by the Free Software Foundation, either version 3 of the
  15. * License, or (at your option) any later version.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  24. *
  25. */
  26. namespace OC\Security\RateLimiting\Backend;
  27. use OCP\AppFramework\Utility\ITimeFactory;
  28. use OCP\DB\QueryBuilder\IQueryBuilder;
  29. use OCP\IConfig;
  30. use OCP\IDBConnection;
  31. class DatabaseBackend implements IBackend {
  32. private const TABLE_NAME = 'ratelimit_entries';
  33. /** @var IConfig */
  34. private $config;
  35. /** @var IDBConnection */
  36. private $dbConnection;
  37. /** @var ITimeFactory */
  38. private $timeFactory;
  39. public function __construct(
  40. IConfig $config,
  41. IDBConnection $dbConnection,
  42. ITimeFactory $timeFactory
  43. ) {
  44. $this->config = $config;
  45. $this->dbConnection = $dbConnection;
  46. $this->timeFactory = $timeFactory;
  47. }
  48. /**
  49. * @param string $methodIdentifier
  50. * @param string $userIdentifier
  51. * @return string
  52. */
  53. private function hash(string $methodIdentifier,
  54. string $userIdentifier): string {
  55. return hash('sha512', $methodIdentifier . $userIdentifier);
  56. }
  57. /**
  58. * @param string $identifier
  59. * @param int $seconds
  60. * @return int
  61. * @throws \OCP\DB\Exception
  62. */
  63. private function getExistingAttemptCount(
  64. string $identifier
  65. ): int {
  66. $currentTime = $this->timeFactory->getDateTime();
  67. $qb = $this->dbConnection->getQueryBuilder();
  68. $qb->delete(self::TABLE_NAME)
  69. ->where(
  70. $qb->expr()->lte('delete_after', $qb->createNamedParameter($currentTime, IQueryBuilder::PARAM_DATE))
  71. )
  72. ->executeStatement();
  73. $qb = $this->dbConnection->getQueryBuilder();
  74. $qb->select($qb->func()->count())
  75. ->from(self::TABLE_NAME)
  76. ->where(
  77. $qb->expr()->eq('hash', $qb->createNamedParameter($identifier, IQueryBuilder::PARAM_STR))
  78. );
  79. $cursor = $qb->executeQuery();
  80. $row = $cursor->fetchOne();
  81. $cursor->closeCursor();
  82. return (int)$row;
  83. }
  84. /**
  85. * {@inheritDoc}
  86. */
  87. public function getAttempts(string $methodIdentifier,
  88. string $userIdentifier): int {
  89. $identifier = $this->hash($methodIdentifier, $userIdentifier);
  90. return $this->getExistingAttemptCount($identifier);
  91. }
  92. /**
  93. * {@inheritDoc}
  94. */
  95. public function registerAttempt(string $methodIdentifier,
  96. string $userIdentifier,
  97. int $period) {
  98. $identifier = $this->hash($methodIdentifier, $userIdentifier);
  99. $deleteAfter = $this->timeFactory->getDateTime()->add(new \DateInterval("PT{$period}S"));
  100. $qb = $this->dbConnection->getQueryBuilder();
  101. $qb->insert(self::TABLE_NAME)
  102. ->values([
  103. 'hash' => $qb->createNamedParameter($identifier, IQueryBuilder::PARAM_STR),
  104. 'delete_after' => $qb->createNamedParameter($deleteAfter, IQueryBuilder::PARAM_DATE),
  105. ]);
  106. if (!$this->config->getSystemValueBool('ratelimit.protection.enabled', true)) {
  107. return;
  108. }
  109. $qb->executeStatement();
  110. }
  111. }