Closes#81. GET ?password= and X-Paste-Password verifications now go through the per-IP unlock limiter (5/min per paste) alongside the existing POST form path. Regression tests prove repeated wrong passwords via GET yield 429.
Closes #81. GET ?password= and X-Paste-Password verifications now go through the per-IP unlock limiter (5/min per paste) alongside the existing POST form path. Regression tests prove repeated wrong passwords via GET yield 429.
GET ?password= and X-Paste-Password header checks in handleGetPaste were
unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password
verification on the same per-IP+paste unlock limiter (5/min, 429 with
Retry-After) already used by the POST unlock form path.
Regression tests: repeated wrong passwords via GET ?password= and via
header must eventually 429; correct password within burst still 200.
Fixes#81
poslop
merged commit 806798fae6 into main2026-09-09 15:59:24 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #81. GET ?password= and X-Paste-Password verifications now go through the per-IP unlock limiter (5/min per paste) alongside the existing POST form path. Regression tests prove repeated wrong passwords via GET yield 429.