From 41d39971362935adcb86f9296cab2e1576536f20 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sat, 19 Sep 2026 10:50:53 +0200 Subject: [PATCH] fix(admin-audit): Log when BFP was bypassed Signed-off-by: Joas Schilling --- lib/private/Security/Bruteforce/Throttler.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/private/Security/Bruteforce/Throttler.php b/lib/private/Security/Bruteforce/Throttler.php index 6d6384fe99310..f6339edfb72e3 100644 --- a/lib/private/Security/Bruteforce/Throttler.php +++ b/lib/private/Security/Bruteforce/Throttler.php @@ -13,7 +13,9 @@ use OC\Security\Ip\BruteforceAllowList; use OC\Security\Normalizer\IpAddress; use OCP\AppFramework\Utility\ITimeFactory; +use OCP\EventDispatcher\IEventDispatcher; use OCP\IConfig; +use OCP\Log\Audit\CriticalActionPerformedEvent; use OCP\Security\Bruteforce\IThrottler; use OCP\Security\Bruteforce\MaxDelayReached; use Psr\Log\LoggerInterface; @@ -41,6 +43,7 @@ public function __construct( private IConfig $config, private IBackend $backend, private BruteforceAllowList $allowList, + private IEventDispatcher $dispatcher, ) { } @@ -58,6 +61,12 @@ public function registerAttempt(string $action, $ipAddress = new IpAddress($ip); if ($this->isBypassListed((string)$ipAddress)) { + $this->dispatcher->dispatchTyped( + new CriticalActionPerformedEvent( + 'Bruteforce attempt from "{ip}" detected for action "{action}".', + ['ip' => $ip, 'action' => $action], + ) + ); return; }