passwordauth: avoid userinfo forgery via repeated email parameter

[git.ikiwiki.info.git] / doc / plugins / contrib / unixauth / discussion.mdwn

diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn
index c4f5ff2690395eec89cc5142856778f59ba1de2a..232649863c9dff898737d15c253850bac8648513 100644 (file)
--- a/doc/plugins/contrib/unixauth/discussion.mdwn
+++ b/doc/plugins/contrib/unixauth/discussion.mdwn
@@ -30,3 +30,9 @@ I've added support for [checkpassword](http://cr.yp.to/checkpwd/interface.html),
 > I actually think that the rate limiting is a good thing. After all,
 > ikiwiki doesn't do its own login rate limiting. Just need to find a way
 > to disentangle the two locks. --[[Joey]]
+
+>> Ah, ok, I misunderstood your comment. I'll see what I can figure out. --[[schmonz]]
+
+>>> My time's been limited for this, but I just saw [[todo/avoid_thrashing]]. How does that interact with pwauth or checkpassword? --[[schmonz]]
+
+>>>> The DOS still happens, it just uses less memory. --[[Joey]]