Merge branch 'staging' into immutable-config

eb31d7baa2a0d1f0441902961ffb8bdfad6ac27e

Cohee <18619528+Cohee1207@users.noreply.github.com>

default/config.yaml+5 -0 Viewed

 disableCsrfProtection: false
 # Disable startup security checks - NOT RECOMMENDED
 securityOverride: false
 +# -- RATE LIMITING CONFIGURATION --
 +rateLimiting:
 +  # Use X-Real-IP header instead of socket IP for rate limiting
 +  # Only enable this if you are using a properly configured reverse proxy (like Nginx/traefik/Caddy)
 +  preferRealIpHeader: false
 # -- ADVANCED CONFIGURATION --
 # Open the browser automatically
 autorun: true

src/endpoints/users-public.js+10 -7 Viewed

 import storage from 'node-persist';
 import express from 'express';
 import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible';
 import { jsonParser, getIpFromRequest, getRealIpFromHeader } from '../express-common.js';
 import { color, Cache, getConfigValue } from '../util.js';
 import { KEY_PREFIX, getUserAvatar, toKey, getPasswordHash, getPasswordSalt } from '../users.js';
 const DISCREET_LOGIN = getConfigValue('enableDiscreetLogin', false, 'boolean');
 +const PREFER_REAL_IP_HEADER = getConfigValue('rateLimiting.preferRealIpHeader', false, 'boolean');
 const MFA_CACHE = new Cache(5 * 60 * 1000);
 +const getIpAddress = (request) => PREFER_REAL_IP_HEADER ? getRealIpFromHeader(request) : getIpFromRequest(request);
++
 export const router = express.Router();
 const loginLimiter = new RateLimiterMemory({
     points: 5,

             return response.status(400).json({ error: 'Missing required fields' });
+        }
         const ip = getIpFromRequestgetIpAddress(request);
         await loginLimiter.consume(ip);
         /** @type {import('../users.js').User} */

         return response.json({ handle: user.handle });
     } catch (error) {
         if (error instanceof RateLimiterRes) {
             console.error('Login failed: Rate limited from', getIpFromRequestgetIpAddress(request));
             return response.status(429).send({ error: 'Too many attempts. Try again later or recover your password.' });
+        }

             return response.status(400).json({ error: 'Missing required fields' });
+        }
         const ip = getIpFromRequestgetIpAddress(request);
         await recoverLimiter.consume(ip);
         /** @type {import('../users.js').User} */

         return response.sendStatus(204);
     } catch (error) {
         if (error instanceof RateLimiterRes) {
             console.error('Recover step 1 failed: Rate limited from', getIpFromRequestgetIpAddress(request));
             return response.status(429).send({ error: 'Too many attempts. Try again later or contact your admin.' });
+        }

         /** @type {import('../users.js').User} */
         const user = await storage.getItem(toKey(request.body.handle));
         const ip = getIpFromRequestgetIpAddress(request);
         if (!user) {
             console.error('Recover step 2 failed: User', request.body.handle, 'not found');

         return response.sendStatus(204);
     } catch (error) {
         if (error instanceof RateLimiterRes) {
             console.error('Recover step 2 failed: Rate limited from', getIpFromRequestgetIpAddress(request));
             return response.status(429).send({ error: 'Too many attempts. Try again later or contact your admin.' });
+        }

src/express-common.js+14 -0 Viewed

+    }
     return clientIp;
+}
++
 +/**
 + * Gets the IP address of the client when behind reverse proxy using x-real-ip header, falls back to socket remote address.
 + * This function should be used when the application is running behind a reverse proxy (e.g., Nginx, traefik, Caddy...).
 + * @param {import('express').Request} req Request object
 + * @returns {string} IP address of the client
 + */
 +export function getRealIpFromHeader(req) {
 +    if (req.headers['x-real-ip']) {
 +        return req.headers['x-real-ip'].toString();
 +    }
++
 +    return getIpFromRequest(req);
 +}