cloudpods

mirror of https://hubproxy.babadafafafafa.cn/https://github.com/yunionio/cloudpods.git synced 2026-09-20 08:03:53 +08:00

Files

History

Jian Qiu 9c88aa36d8 fix(notify): harden verification code generation and verification (#25483 )

- Generate verification codes with crypto/rand instead of the
  predictable time-seeded math/rand
- Count failed verification attempts and invalidate the code after
  verify_max_attempts (default 5) failures, closing the unlimited
  online brute force of the 6-digit code at the login endpoint
- Delete the verification record after a successful check so codes
  are single use and can not be replayed within the validity window
- Add unit tests for code generation

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-03 23:49:29 +08:00