penpot

mirror of https://github.com/penpot/penpot.git synced 2026-09-23 20:36:15 +00:00

History

✨ Add account lockout after failed login attempts (#11402 )

* ✨ Add account lockout after failed login attempts

Implement per-account brute-force protection using a Redis-backed
failed-login counter. After 5 failed attempts within 15 minutes, the
account is temporarily locked out and all login attempts (including
with the correct password) are rejected with a 429 response.

Closes #11397

AI-assisted-by: longcat-2.0

* 🐛 Bind LDAP session to directory-verified profile

The account-lockout change added a shortcut that preferred the
profile matching the typed email over the one returned by the LDAP
directory. These can differ with aliases, UPNs, or multi-valued mail
attributes, letting a user with valid LDAP credentials bind a session
to another Penpot account.

Keep the typed-email profile only for lockout checks. After LDAP
succeeds, resolve the session profile from the directory identity as
before and clear failed attempts on that profile.

AI-assisted-by: deepseek-v4.1-flash

2026-09-23 12:31:50 +02:00

dev

📎 Update copyright name on file header (#11346 )

2026-08-25 11:55:10 +02:00

resources/fonts

🔧 Add exporter headless backend (#10875 )

2026-08-06 16:13:06 +02:00

scripts

⬆️ Update devenv dependencies (#11790 )

2026-09-22 10:22:31 +02:00

src/app/common

✨ Add account lockout after failed login attempts (#11402 )