HexBrain

Nextcloud · Report #1214158

Ratelimits do not apply to OCS DataResponse

Validstatus
4upvotes
11 Aug 2021disclosed

How it was found

Using $response->throttle() on a DataResponse doesn't work as it is being transformed by BaseResponse into a OCS response. This response does not propagate any throttled setting.

Impact

Ratelimits on OCS DataResponse not functional.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original