git.iko.soy/unity8
on xenial help sign in
Initial pass at trying to fix reported lockout bug
09a4e7dMichael Terry
qml/Greeter/Greeter.qml+18−17
compare with xenial
unifiedsplit
@@ -216,36 +216,37 @@ Showable {
216 }
216 }
217
217
218 onTriggered: {
218 onTriggered: {
219− var diff = delayTarget - new Date();
220− if (diff > 0) {
221− delayMinutes = Math.ceil(diff / 60000);
222− start(); // go again
223− } else {
224− delayMinutes = 0;
225− }
226− }
227−
228− function checkForForcedDelay() {
229 var now = new Date();
219 var now = new Date();
230− delayTarget = now;
220+
231− delayTarget.setTime(greeterSettings.lockedOutTime + failedLoginsDelayMinutes * 60000);
221+ // We're going to compare stored time to system time here.
222+ // - We do this every tick (rather than just once at the start)
223+ // because clock time can change while we're running. For example,
224+ // ntpdate runs as an ifupdown script.
225+ // - And we trust this check because if a malicious actor is able
226+ // to manipulate time to avoid our lockout, there's not much we
227+ // can do to stop them.
232
228
233 // If tooEarly is true, something went very wrong. Bug or NTP
229 // If tooEarly is true, something went very wrong. Bug or NTP
234 // misconfiguration maybe?
230 // misconfiguration maybe?
235 var tooEarly = now.getTime() < greeterSettings.lockedOutTime;
231 var tooEarly = now.getTime() < greeterSettings.lockedOutTime;
236− var tooLate = now > delayTarget;
232+ var tooLate = now >= delayTarget;
237
233
238− // Compare stored time to system time. If a malicious actor is
239− // able to manipulate time to avoid our lockout, they already have
240− // enough access to cause damage. So we choose to trust this check.
241 if (tooEarly || tooLate) {
234 if (tooEarly || tooLate) {
242 stop();
235 stop();
243 delayMinutes = 0;
236 delayMinutes = 0;
244 } else {
237 } else {
245− triggered();
238+ var diff = delayTarget - now;
239+ delayMinutes = Math.ceil(diff / 60000);
240+ start(); // go again
246 }
241 }
247 }
242 }
248
243
244+ function checkForForcedDelay() {
245+ delayTarget = new Date();
246+ delayTarget.setTime(greeterSettings.lockedOutTime + failedLoginsDelayMinutes * 60000);
247+ triggered();
248+ }
249+
249 Component.onCompleted: checkForForcedDelay()
250 Component.onCompleted: checkForForcedDelay()
250 }
251 }
251
252