Repository navigation
docs(15.10): describe the login form rate limit, multi-line X-Forwarded-For and (deny) permissions - #611
Merged
Conversation
…ed-For and (deny) permissions
The three 15.10 behavior changes below are not in the 15.10 tree yet. What was
observed on a running server (public 15.9.0 compared with 15.10.0-SNAPSHOT) and
what was read from the code:
- Login form limit (fess#3675). Observed: five rejected passwords for one user
name from one address make the sixth attempt, with the correct password, fail
with the message of a rejected password; a failed attempt is counted per
(address, user); 25 successful logins in a row are never refused. In 15.9.0
the same sequence logs in. Read from the code, not observed: the per-address
limit of the form.
- Multi-line X-Forwarded-For (fess#3680). Observed on /api/v2/auth/login: with a
made-up first header line and the real address in a second line, 15.10 limits
the attempts by the second line and 15.9.0 by the first. The same reading
is shared by the login form.
- (deny) with a space (fess#3685). Observed through the admin API: 15.9.0 stores
"(deny) {user}name" as the text " {user}name", the user still finds the
document, and putting the returned value back stores "1name" (an allow);
15.10 stores "D1name", hides the document and keeps it after the same PUT.
Saving the edit screen goes through the same code, which was not exercised.
Changes:
- api-auth.rst: theme.api.login.rate.limit.* no longer applies only to
/auth/login; the login form of the login page uses the same limits.
- rate-limiting.rst: X-Forwarded-For split over several header lines is read
as one chain, from the right.
- upgrade.rst, "15.9 to 15.10": the login form limit, the multi-line
X-Forwarded-For and the (deny) change. A setting saved by 15.9 is not repaired
by the upgrade and has to be written again.
All seven language trees (de, en, es, fr, ja, ko, zh-cn) are updated, as the
other 15.10 documentation changes do.
1 of 2 tasks
marevol
added this pull request to stack #614
October 25, 2026 06:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Describes three 15.10 behavior changes that the 15.10 tree does not mention yet. Statements were checked on a running server (15.9.0 compared with 15.10.0-SNAPSHOT) unless marked as read from the code.
X-Forwarded-For(fix(login): read every X-Forwarded-For header line when attributing a request fess#3680): observed on/api/v2/auth/login; 15.10 limits by the address from the last line, 15.9.0 by the first line.(deny)followed by a space (fix(permission): keep deny entries and make encode/decode round-trip fess#3685): observed through the admin API; 15.9.0 stores the text with the space and a later PUT turns it into an allow, 15.10 keeps the deny.Changes
api-auth.rst: thetheme.api.login.rate.limit.*limits also apply to the login form.rate-limiting.rst: how severalX-Forwarded-Forlines are read.upgrade.rst(15.9 to 15.10): the three changes, and that a(deny)line saved by 15.9 has to be written again.All seven language trees are updated. The de, es, fr, ko and zh-cn texts are translations of the ja/en text and have not been reviewed by a native speaker.
Test plan
rst2htmlshows no underline or indent warnings on the changed files