Fix incorrect rate limit on PUT requests (mastodon#31356)

nileane · Aug 9, 2024 · eaedd52 · eaedd52
1 parent 1701575
commit eaedd52
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
@@ -142,7 +142,7 @@ def paging_request?
   end
 
   throttle('throttle_password_change/account', limit: 10, period: 10.minutes) do |req|
-    req.warden_user_id if req.put? || (req.patch? && req.path_matches?('/auth'))
+    req.warden_user_id if (req.put? || req.patch?) && (req.path_matches?('/auth') || req.path_matches?('/auth/password'))
   end
 
   self.throttled_responder = lambda do |request|