Merge pull request #689 from whitj00/patch-4
New issue Don't reveal whether password is <20 or >20 characters in RPC
This commit is contained in:
commit
ba4e0d315c
1 changed files with 2 additions and 3 deletions
|
@ -827,11 +827,10 @@ void ServiceConnection(AcceptedConnection *conn)
|
|||
if (!HTTPAuthorized(mapHeaders))
|
||||
{
|
||||
LogPrintf("ThreadRPCServer incorrect password attempt from %s\n", conn->peer_address_to_string());
|
||||
/* Deter brute-forcing short passwords.
|
||||
/* Deter brute-forcing
|
||||
If this results in a DoS the user really
|
||||
shouldn't have their RPC port exposed. */
|
||||
if (mapArgs["-rpcpassword"].size() < 20)
|
||||
MilliSleep(250);
|
||||
MilliSleep(250);
|
||||
|
||||
conn->stream() << HTTPReply(HTTP_UNAUTHORIZED, "", false) << std::flush;
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue