Konfigurationsoption für Wartezeit nach fehlgeschlagenen Logins

diff --git a/SL/Auth.pm b/SL/Auth.pm
index ed5c84543c8762d017a40aaa78f9e0f09e0f9f3d..52c2dc63de55510ce115ade02d53387d32f82368 100644 (file)
--- a/SL/Auth.pm
+++ b/SL/Auth.pm
@@ -194,7 +194,8 @@ sub authenticate {
 }
 
 sub punish_wrong_login {
 }
 
 sub punish_wrong_login {

-  sleep 5;
+  my $failed_login_penalty = ($::lx_office_conf{authentication} || {})->{failed_login_penalty};
+  sleep $failed_login_penalty if $failed_login_penalty;

 }
 
 sub get_stored_password {
 }
 
 sub get_stored_password {

diff --git a/config/kivitendo.conf.default b/config/kivitendo.conf.default
index 879dab0b9b4f0c06c12bf83bd061a4bd92a99b07..127eb3c5626f7017ab548df920cbfc9c7ed024dd 100644 (file)
--- a/config/kivitendo.conf.default
+++ b/config/kivitendo.conf.default
@@ -16,6 +16,10 @@ cookie_name = kivitendo_session_id
 # hours.
 session_timeout = 480
 
 # hours.
 session_timeout = 480
 

+# The number of seconds to penalize failed login attempts. 0 disables
+# it.
+failed_login_penalty = 5
+

 [authentication/database]
 # Connection information for the database with the user and group
 # inforamtion.  This information is always needed, even if LDAP is
 [authentication/database]
 # Connection information for the database with the user and group
 # inforamtion.  This information is always needed, even if LDAP is