From e65289e5fd8b85e2a8c780127d184f64e6bd2d4e Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sat, 19 Sep 2026 10:50:53 +0200 Subject: [PATCH] fix(admin-audit): Log when BFP was bypassed Signed-off-by: Joas Schilling --- lib/private/Security/Bruteforce/Throttler.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/private/Security/Bruteforce/Throttler.php b/lib/private/Security/Bruteforce/Throttler.php index 574f6c80c3fae..9882e8b68645c 100644 --- a/lib/private/Security/Bruteforce/Throttler.php +++ b/lib/private/Security/Bruteforce/Throttler.php @@ -12,7 +12,9 @@ use OC\Security\Ip\BruteforceAllowList; use OC\Security\Normalizer\IpAddress; use OCP\AppFramework\Utility\ITimeFactory; +use OCP\EventDispatcher\IEventDispatcher; use OCP\IConfig; +use OCP\Log\Audit\CriticalActionPerformedEvent; use OCP\Security\Bruteforce\IThrottler; use OCP\Security\Bruteforce\MaxDelayReached; use Psr\Log\LoggerInterface; @@ -40,6 +42,7 @@ public function __construct( private IConfig $config, private IBackend $backend, private BruteforceAllowList $allowList, + private IEventDispatcher $dispatcher, ) { } @@ -56,6 +59,12 @@ public function registerAttempt(string $action, $ipAddress = new IpAddress($ip); if ($this->isBypassListed((string)$ipAddress)) { + $this->dispatcher->dispatchTyped( + new CriticalActionPerformedEvent( + 'Bruteforce attempt from "{ip}" detected for action "{action}" not throttled due to allow-list.', + ['ip' => $ip, 'action' => $action], + ) + ); return; }