Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#1073 Add delay to email recovery command

Browse Source 
- Add configurable cooldown period after sending an email for /email recovery
- Change ExpiringMap to remove expired entries (like ExpiringSet)
- Create method to translate durations via the messages file
This commit is contained in:
ljacqu
2017-02-25 22:41:49 +01:00
parent a4b440bcca
commit c197a330f3
11 changed files with 252 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/fr/xephi/authme/command/executable/email/RecoverEmailCommand.java
+46 -3
View File
@@ -5,24 +5,31 @@ import fr.xephi.authme.command.PlayerCommand;
import fr.xephi.authme.data.auth.PlayerAuth;
import fr.xephi.authme.data.auth.PlayerCache;
import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.initialization.Reloadable;
import fr.xephi.authme.mail.EmailService;
import fr.xephi.authme.message.MessageKey;
import fr.xephi.authme.message.Messages;
import fr.xephi.authme.security.PasswordSecurity;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.service.CommonService;
import fr.xephi.authme.service.RecoveryCodeService;
import fr.xephi.authme.settings.properties.SecuritySettings;
import fr.xephi.authme.util.RandomStringUtils;
import fr.xephi.authme.util.expiring.Duration;
import fr.xephi.authme.util.expiring.ExpiringSet;
import org.bukkit.entity.Player;
import javax.annotation.PostConstruct;
import javax.inject.Inject;
import java.util.List;
import java.util.concurrent.TimeUnit;
import static fr.xephi.authme.settings.properties.EmailSettings.RECOVERY_PASSWORD_LENGTH;
/**
* Command for password recovery by email.
*/
public class RecoverEmailCommand extends PlayerCommand {
public class RecoverEmailCommand extends PlayerCommand implements Reloadable {
@Inject
private PasswordSecurity passwordSecurity;
@@ -42,8 +49,19 @@ public class RecoverEmailCommand extends PlayerCommand {
@Inject
private RecoveryCodeService recoveryCodeService;
@Inject
private Messages messages;
private ExpiringSet<String> emailCooldown;
@PostConstruct
private void initEmailCooldownSet() {
emailCooldown = new ExpiringSet<>(
commonService.getProperty(SecuritySettings.EMAIL_RECOVERY_COOLDOWN_SECONDS), TimeUnit.SECONDS);
}
@Override
public void runCommand(Player player, List<String> arguments) {
protected void runCommand(Player player, List<String> arguments) {
final String playerMail = arguments.get(0);
final String playerName = player.getName();
@@ -78,15 +96,29 @@ public class RecoverEmailCommand extends PlayerCommand {
processRecoveryCode(player, arguments.get(1), email);
}
} else {
generateAndSendNewPassword(player, email);
boolean maySendMail = checkEmailCooldown(player);
if (maySendMail) {
generateAndSendNewPassword(player, email);
}
}
}
@Override
public void reload() {
emailCooldown.setExpiration(
commonService.getProperty(SecuritySettings.EMAIL_RECOVERY_COOLDOWN_SECONDS), TimeUnit.SECONDS);
}
private void createAndSendRecoveryCode(Player player, String email) {
if (!checkEmailCooldown(player)) {
return;
}
String recoveryCode = recoveryCodeService.generateCode(player.getName());
boolean couldSendMail = emailService.sendRecoveryCode(player.getName(), email, recoveryCode);
if (couldSendMail) {
commonService.send(player, MessageKey.RECOVERY_CODE_SENT);
emailCooldown.add(player.getName().toLowerCase());
} else {
commonService.send(player, MessageKey.EMAIL_SEND_FAILURE);
}
@@ -111,8 +143,19 @@ public class RecoverEmailCommand extends PlayerCommand {
boolean couldSendMail = emailService.sendPasswordMail(name, email, thePass);
if (couldSendMail) {
commonService.send(player, MessageKey.RECOVERY_EMAIL_SENT_MESSAGE);
emailCooldown.add(player.getName().toLowerCase());
} else {
commonService.send(player, MessageKey.EMAIL_SEND_FAILURE);
}
}
private boolean checkEmailCooldown(Player player) {
Duration waitDuration = emailCooldown.getExpiration(player.getName().toLowerCase());
if (waitDuration.getDuration() > 0) {
String durationText = messages.formatDuration(waitDuration);
messages.send(player, MessageKey.EMAIL_COOLDOWN_ERROR, durationText);
return false;
}
return true;
}
}
src/main/java/fr/xephi/authme/message/MessageKey.java
+29 -1
View File
@@ -225,7 +225,35 @@ public enum MessageKey {
RECOVERY_CODE_SENT("recovery_code_sent"),
/** The recovery code is not correct! Use "/email recovery [email]" to generate a new one */
INCORRECT_RECOVERY_CODE("recovery_code_incorrect");
INCORRECT_RECOVERY_CODE("recovery_code_incorrect"),
/** An email was already sent recently. You must wait %time before you can send a new one. */
EMAIL_COOLDOWN_ERROR("email_cooldown_error", "%time"),
/** second */
SECOND("second"),
/** seconds */
SECONDS("seconds"),
/** minute */
MINUTE("minute"),
/** minutes */
MINUTES("minutes"),
/** hour */
HOUR("hour"),
/** hours */
HOURS("hours"),
/** day */
DAY("day"),
/** days */
DAYS("days");
private String key;
private String[] tags;
src/main/java/fr/xephi/authme/message/Messages.java
+34
View File
@@ -1,11 +1,15 @@
package fr.xephi.authme.message;
import com.google.common.collect.ImmutableMap;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.initialization.Reloadable;
import fr.xephi.authme.util.expiring.Duration;
import org.bukkit.ChatColor;
import org.bukkit.command.CommandSender;
import javax.inject.Inject;
import java.util.Map;
import java.util.concurrent.TimeUnit;
/**
* Class for retrieving and sending translatable messages to players.
@@ -15,6 +19,20 @@ public class Messages implements Reloadable {
// Custom Authme tag replaced to new line
private static final String NEWLINE_TAG = "%nl%";
/** Contains the keys of the singular messages for time units. */
private static final Map<TimeUnit, MessageKey> TIME_UNIT_SINGULARS = ImmutableMap.<TimeUnit, MessageKey>builder()
.put(TimeUnit.SECONDS, MessageKey.SECOND)
.put(TimeUnit.MINUTES, MessageKey.MINUTE)
.put(TimeUnit.HOURS, MessageKey.HOUR)
.put(TimeUnit.DAYS, MessageKey.DAY).build();
/** Contains the keys of the plural messages for time units. */
private static final Map<TimeUnit, MessageKey> TIME_UNIT_PLURALS = ImmutableMap.<TimeUnit, MessageKey>builder()
.put(TimeUnit.SECONDS, MessageKey.SECONDS)
.put(TimeUnit.MINUTES, MessageKey.MINUTES)
.put(TimeUnit.HOURS, MessageKey.HOURS)
.put(TimeUnit.DAYS, MessageKey.DAYS).build();
private final MessageFileHandlerProvider messageFileHandlerProvider;
private MessageFileHandler messageFileHandler;
@@ -71,6 +89,22 @@ public class Messages implements Reloadable {
return message.split("\n");
}
/**
* Returns the textual representation for the given duration.
* Note that this class only supports the time units days, hour, minutes and seconds.
*
* @param duration the duration to build a text of
* @return text of the duration
*/
public String formatDuration(Duration duration) {
long value = duration.getDuration();
MessageKey timeUnitKey = value == 1
? TIME_UNIT_SINGULARS.get(duration.getTimeUnit())
: TIME_UNIT_PLURALS.get(duration.getTimeUnit());
return value + " " + retrieveMessage(timeUnitKey);
}
/**
* Retrieve the message from the text file.
*
src/main/java/fr/xephi/authme/settings/properties/SecuritySettings.java
+7
View File
@@ -114,6 +114,13 @@ public class SecuritySettings implements SettingsHolder {
public static final Property<Integer> RECOVERY_CODE_HOURS_VALID =
newProperty("Security.recoveryCode.validForHours", 4);
@Comment({
"Seconds a user has to wait for before a password recovery mail may be sent again",
"This prevents an attacker from abusing AuthMe's email feature."
})
public static final Property<Integer> EMAIL_RECOVERY_COOLDOWN_SECONDS =
newProperty("Security.emailRecovery.cooldown", 60);
private SecuritySettings() {
}
src/main/java/fr/xephi/authme/util/Utils.java
-33
View File
@@ -3,7 +3,6 @@ package fr.xephi.authme.util;
import fr.xephi.authme.ConsoleLogger;
import java.util.Collection;
import java.util.concurrent.TimeUnit;
import java.util.regex.Pattern;
/**
@@ -71,36 +70,4 @@ public final class Utils {
return Runtime.getRuntime().availableProcessors();
}
public static Duration convertMillisToSuitableUnit(long duration) {
TimeUnit targetUnit;
if (duration > 1000L * 60L * 60L * 24L) {
targetUnit = TimeUnit.DAYS;
} else if (duration > 1000L * 60L * 60L) {
targetUnit = TimeUnit.HOURS;
} else if (duration > 1000L * 60L) {
targetUnit = TimeUnit.MINUTES;
} else if (duration > 1000L) {
targetUnit = TimeUnit.SECONDS;
} else {
targetUnit = TimeUnit.MILLISECONDS;
}
return new Duration(targetUnit, duration);
}
public static final class Duration {
private final long duration;
private final TimeUnit unit;
Duration(TimeUnit targetUnit, long durationMillis) {
this(targetUnit, durationMillis, TimeUnit.MILLISECONDS);
}
Duration(TimeUnit targetUnit, long sourceDuration, TimeUnit sourceUnit) {
this.duration = targetUnit.convert(sourceDuration, sourceUnit);
this.unit = targetUnit;
}
}
}
src/main/java/fr/xephi/authme/util/expiring/ExpiringMap.java
+8 -2
View File
@@ -46,7 +46,13 @@ public class ExpiringMap<K, V> {
*/
public V get(K key) {
ExpiringEntry<V> value = entries.get(key);
return value == null ? null : value.getValue();
if (value == null) {
return null;
} else if (System.currentTimeMillis() > value.getExpiration()) {
entries.remove(key);
return null;
}
return value.getValue();
}
/**
@@ -115,7 +121,7 @@ public class ExpiringMap<K, V> {
}
V getValue() {
return System.currentTimeMillis() > expiration ? null : value;
return value;
}
long getExpiration() {
src/main/java/fr/xephi/authme/util/expiring/ExpiringSet.java
+5 -6
View File
@@ -83,23 +83,22 @@ public class ExpiringSet<E> {
/**
* Returns the duration of the entry until it expires (provided it is not removed or re-added).
* If the entry does not exist, -1 is returned.
* If the entry does not exist, a duration of -1 seconds is returned.
*
* @param entry the entry whose duration before it expires should be returned
* @param unit the unit in which to return the duration
* @return duration the entry will remain in the set (if there are not modifications)
*/
public long getExpiration(E entry, TimeUnit unit) {
public Duration getExpiration(E entry) {
Long expiration = entries.get(entry);
if (expiration == null) {
return -1;
return new Duration(-1, TimeUnit.SECONDS);
}
long stillPresentMillis = expiration - System.currentTimeMillis();
if (stillPresentMillis < 0) {
entries.remove(entry);
return -1;
return new Duration(-1, TimeUnit.SECONDS);
}
return unit.convert(stillPresentMillis, TimeUnit.MILLISECONDS);
return Duration.createWithSuitableUnit(stillPresentMillis, TimeUnit.MILLISECONDS);
}
/**
src/main/java/fr/xephi/authme/util/expiring/TimedCounter.java
+2 -2
View File
@@ -1,6 +1,5 @@
package fr.xephi.authme.util.expiring;
import java.util.Objects;
import java.util.concurrent.TimeUnit;
/**
@@ -42,9 +41,10 @@ public class TimedCounter<K> extends ExpiringMap<K, Integer> {
* @return the total of all valid entries
*/
public int total() {
long currentTime = System.currentTimeMillis();
return entries.values().stream()
.filter(entry -> currentTime <= entry.getExpiration())
.map(ExpiringEntry::getValue)
.filter(Objects::nonNull)
.reduce(0, Integer::sum);
}
}