diff options
| -rw-r--r-- | lib/Controller/PageController.php | 8 | ||||
| -rw-r--r-- | lib/Controller/RecordingController.php | 17 |
2 files changed, 25 insertions, 0 deletions
diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php index 892b2df0e..f3d710b5b 100644 --- a/lib/Controller/PageController.php +++ b/lib/Controller/PageController.php @@ -296,6 +296,7 @@ class PageController extends Controller { #[NoCSRFRequired] #[PublicPage] #[BruteForceProtection(action: 'talkRoomToken')] + #[BruteForceProtection(action: 'talkRecordingStatus')] public function recording(string $token): Response { try { $room = $this->manager->getRoomByToken($token); @@ -306,6 +307,13 @@ class PageController extends Controller { return $response; } + if ($room->getCallRecording() !== Room::RECORDING_VIDEO_STARTING && $room->getCallRecording() !== Room::RECORDING_AUDIO_STARTING) { + $response = new NotFoundResponse(); + $this->logger->debug('Recording "' . ($this->userId ?? 'ANONYMOUS') . '" throttled for accessing "' . $token . '"', ['app' => 'spreed-bfp']); + $response->throttle(['token' => $token, 'action' => 'talkRecordingStatus']); + return $response; + } + if (class_exists(LoadViewer::class)) { $this->eventDispatcher->dispatchTyped(new LoadViewer()); } diff --git a/lib/Controller/RecordingController.php b/lib/Controller/RecordingController.php index e612e9f3d..76d5ef91a 100644 --- a/lib/Controller/RecordingController.php +++ b/lib/Controller/RecordingController.php @@ -178,6 +178,7 @@ class RecordingController extends AEnvironmentAwareController { #[IgnoreOpenAPI] #[PublicPage] #[BruteForceProtection(action: 'talkRecordingSecret')] + #[BruteForceProtection(action: 'talkRecordingStatus')] public function backend(): DataResponse { $json = $this->getInputStream(); if (!$this->validateBackendRequest($json)) { @@ -235,6 +236,22 @@ class RecordingController extends AEnvironmentAwareController { ], Http::STATUS_NOT_FOUND); } + if ($room->getCallRecording() !== Room::RECORDING_VIDEO_STARTING && $room->getCallRecording() !== Room::RECORDING_AUDIO_STARTING) { + $this->logger->error('Recording backend tried to start recording in room {token}, but it was not requested by a moderator.', [ + 'token' => $token, + 'app' => 'spreed-recording', + ]); + $response = new DataResponse([ + 'type' => 'error', + 'error' => [ + 'code' => 'no_such_room', + 'message' => 'Room not found.', + ], + ], Http::STATUS_NOT_FOUND); + $response->throttle(['action' => 'talkRecordingStatus']); + return $response; + } + try { $participant = $this->participantService->getParticipantByActor($room, $actor['type'], $actor['id']); } catch (ParticipantNotFoundException $e) { |