Add rate limiter to Special:ConfirmEmail

General hardening measure for Special:ConfirmEmail, similar to what's
already in place for Special:ChangeEmail.

Bug: T226733
Change-Id: I465e4748840e214531e930608386455084563bc6

diff --git a/RELEASE-NOTES-1.34 b/RELEASE-NOTES-1.34
index 9660e9e..e98c943 100644 (file)
--- a/RELEASE-NOTES-1.34
+++ b/RELEASE-NOTES-1.34
@@ -39,6 +39,7 @@ For notes on 1.33.x and older releases, see HISTORY.
 * editmyuserjsredirect user right – users without this right now cannot edit JS
   redirects in their userspace unless the target of the redirect is also in
   their userspace. By default, this right is given to everyone.
+* (T226733) Add rate limiter to Special:ConfirmEmail.
 
 ==== Changed configuration ====
 * $wgUseCdn, $wgCdnServers, $wgCdnServersNoPurge, and $wgCdnMaxAge – These four

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index fea5ff9..208cfe6 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -5711,6 +5711,11 @@ $wgRateLimits = [
                'ip-all' => [ 10, 3600 ],
                'user' => [ 4, 86400 ]
        ],
+       // since 1.33 - rate limit email confirmations
+       'confirmemail' => [
+               'ip-all' => [ 10, 3600 ],
+               'user' => [ 4, 86400 ]
+       ],
        // Purging pages
        'purge' => [
                'ip' => [ 30, 60 ],

diff --git a/includes/specials/SpecialConfirmemail.php b/includes/specials/SpecialConfirmemail.php
index 99e6dde..7f32719 100644 (file)
--- a/includes/specials/SpecialConfirmemail.php
+++ b/includes/specials/SpecialConfirmemail.php
@@ -155,6 +155,13 @@ class EmailConfirmation extends UnlistedSpecialPage {
                        return;
                }
 
+               // rate limit email confirmations
+               if ( $user->pingLimiter( 'confirmemail' ) ) {
+                       $this->getOutput()->addWikiMsg( 'actionthrottledtext' );
+
+                       return;
+               }
+
                $user->confirmEmail();
                $user->saveSettings();
                $message = $this->getUser()->isLoggedIn() ? 'confirmemail_loggedin' : 'confirmemail_success';