- Issue created by @chfoidl
- Status changed to Fixed
6 months ago 11:45am 10 January 2024 Automatically closed - issue fixed for 2 weeks with no activity.
The sending of emails by the passwordless login rest resource is not limited in any way.
This could enable an attacker to send out an unlimited flood of login emails to a victim, if the victims email address is known.
Integrate the flood module, similar to how Drupal Core does it for user logins and in the basic auth module, but with dedicated ip and user limits and windows.
The per-user flood events should also be cleared if the user logs in successfully.
Fixed
1.0
Code
Automatically closed - issue fixed for 2 weeks with no activity.