From ce1f25f2ebe10df7e6f557eae4224ca15c022905 Mon Sep 17 00:00:00 2001 From: MelekTaus Date: Thu, 15 Oct 2026 23:12:10 +0200 Subject: [PATCH] Prune old sign-in failures by their current time (#427) The CI gate of cfd6d7a was red in limits.test.php: "pruning drops an address whose failures are all old". PHP 8.2 in the CI image still answered the modification time it had cached before the test moved it back, PHP 8.5 on stein2 did not. - LoginThrottle::prune() clears the stat cache before it reads times. Tests: limits.test.php in feuerwerk-ci (PHP 8.2.34) 21/21, red before. Co-Authored-By: Claude Opus 5.5 --- api/lib/LoginThrottle.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/api/lib/LoginThrottle.php b/api/lib/LoginThrottle.php index e1952350..fce40235 100644 --- a/api/lib/LoginThrottle.php +++ b/api/lib/LoginThrottle.php @@ -78,6 +78,9 @@ final class LoginThrottle /** Removes the files of addresses whose failures are all too old to matter. */ public function prune(): int { + // PHP keeps what it learned of a file for the rest of the request; a time read earlier + // would keep a file that has gone stale since, or drop one written since. + clearstatcache(); $removed = 0; foreach (glob($this->dir . '/*.json') ?: [] as $path) { if ((int) filemtime($path) < $this->now() - 2 * self::WINDOW_SECONDS && unlink($path)) {