Added usleep :(

Signed-off-by: snipe <snipe@snipe.net>
snipe · Feb 16, 2022 · 178e440 · 178e440
1 parent 321be47
commit 178e440
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/app/Http/Controllers/Auth/ForgotPasswordController.php b/app/Http/Controllers/Auth/ForgotPasswordController.php
@@ -87,6 +87,8 @@ public function sendResetLinkEmail(Request $request)
             \Log::info('Password reset attempt: User '.$request->input('username').'failed with exception: '.$e );
         }
 
+        // Prevent timing attack to enumerate users.
+        usleep(500000 + random_int(0, 1500000));
 
         if ($response === \Password::RESET_LINK_SENT) {
             \Log::info('Password reset attempt: User '.$request->input('username').' WAS found, password reset sent');