fix: exit reset password request before passwords are compared (#13856)

2026-09-22 05:05:20 +08:00 · 2024-07-09 14:28:39 -05:00
parent 3894ae17a7
commit d50ffa78f6
5 changed files with 47 additions and 4 deletions
@@ -1018,6 +1018,7 @@ func New(options *Options) *API {
 					})
 					r.Put("/appearance", api.putUserAppearanceSettings)
 					r.Route("/password", func(r chi.Router) {
+						r.Use(httpmw.RateLimit(options.LoginRateLimit, time.Minute))
 						r.Put("/", api.putUserPassword)
 					})
 					// These roles apply to the site wide permissions.