Add rate-limiting for TOTP validation by DL6ER · Pull Request #2719 · pi-hole/FTL

DL6ER · 2025-11-20T18:05:50Z

What does this implement/fix?

Add rate-limiting (max 1/sec) for TOTP validation attempts. Note that this rate-limit applies only after already successful login using the first factor (password). This seeks to avoid a possibility of an DoS attack with known password when 2FA is enabled.

Related issue or feature (if applicable): N/A

Pull request in docs with documentation (if applicable): N/A

By submitting this pull request, I confirm the following:

I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
I have commented my proposed changes within the code.
I am willing to help maintain this change if there are issues with it later.
It is compatible with the EUPL 1.2 license
I have squashed any insignificant commits. (git rebase)

Checklist:

The code change is tested and works locally.
I based my code and PRs against the repositories development branch.
I signed off all commits. Pi-hole enforces the DCO for all contributions
I signed all my commits. Pi-hole requires signatures to verify authorship
I have read the above and my PR is ready for review.

Signed-off-by: Dominik <dl6er@dl6er.de>

yubiuser

Before

2025-11-20 19:49:22.505 UTC [1050182/T1064084] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:31.284 UTC [1050182/T1063980] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:32.290 UTC [1050182/T1063748] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:33.248 UTC [1050182/T1063976] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:34.148 UTC [1050182/T1063977] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:35.131 UTC [1050182/T1062885] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:36.059 UTC [1050182/T1063975] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:36.927 UTC [1050182/T1063979] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:37.852 UTC [1050182/T1063978] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:38.626 UTC [1050182/T1064084] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:39.400 UTC [1050182/T1063980] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:40.117 UTC [1050182/T1063748] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:40.823 UTC [1050182/T1063976] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:49:41.879 UTC [1050182/T1063977] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:51:04.085 UTC [1050182/T1062885] WARNING: API: Invalid 2FA token (key: unauthorized)

After

2025-11-20 19:51:59.186 UTC [1065514/T1065704] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:51:59.769 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:00.421 UTC [1065514/T1065705] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:00.966 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:01.551 UTC [1065514/T1065729] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:02.220 UTC [1065514/T1065705] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:02.590 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:02.893 UTC [1065514/T1065729] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:03.112 UTC [1065514/T1065737] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:03.339 UTC [1065514/T1065705] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:03.511 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:03.694 UTC [1065514/T1065729] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:03.911 UTC [1065514/T1065705] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:04.093 UTC [1065514/T1065760] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:04.285 UTC [1065514/T1065737] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:04.485 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:04.675 UTC [1065514/T1065729] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:04.874 UTC [1065514/T1065705] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:05.386 UTC [1065514/T1065760] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:07.632 UTC [1065514/T1065737] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:07.825 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:08.023 UTC [1065514/T1065729] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:08.058 UTC [1065514/T1065760] WARNING: API: Rate-limiting login attempts (key: rate_limiting)
2025-11-20 19:52:08.206 UTC [1065514/T1065705] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:08.249 UTC [1065514/T1065737] WARNING: API: Rate-limiting login attempts (key: rate_limiting)
2025-11-20 19:52:08.751 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:08.930 UTC [1065514/T1065729] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:09.099 UTC [1065514/T1065760] WARNING: API: Invalid 2FA token (key: unauthorized)
2025-11-20 19:52:09.304 UTC [1065514/T1065705] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:09.494 UTC [1065514/T1065737] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:09.674 UTC [1065514/T1065704] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:09.842 UTC [1065514/T1065729] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:09.999 UTC [1065514/T1065760] WARNING: API: Rate-limiting 2FA token requests, try again later (key: rate_limiting)
2025-11-20 19:52:10.190 UTC [1065514/T1065705] WARNING: API: Invalid 2FA token (key: unauthorized)

pralor-bot · 2025-11-27T20:00:35Z

This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/pi-hole-ftl-v6-4-web-v6-4-and-core-v6-3-released/83680/1

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [pihole/pihole](https://redirect.github.com/pi-hole/docker-pi-hole) | patch | `2025.11.0` -> `2025.11.1` | --- ### Release Notes <details> <summary>pi-hole/docker-pi-hole (pihole/pihole)</summary> ### [`v2025.11.1`](https://redirect.github.com/pi-hole/docker-pi-hole/releases/tag/2025.11.1) [Compare Source](https://redirect.github.com/pi-hole/docker-pi-hole/compare/2025.11.0...2025.11.1)  #### What's Changed (Docker Specific) - Fix build status badge in readme by [@nol166](https://redirect.github.com/nol166) in [#1938](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1938) - Add RISCV back by [@yubiuser](https://redirect.github.com/yubiuser) in [#1939](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1939) - Improve FTL startup detection and log tailing by [@PromoFaux](https://redirect.github.com/PromoFaux) in [#1940](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1940) - Set DNS listening mode to 'ALL' in docker-compose.yml example by [@cornshakes](https://redirect.github.com/cornshakes) in [#1946](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1946) - Add instructions for excluding Pi-hole from Watchtower updates by [@chippy01](https://redirect.github.com/chippy01) in [#1949](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1949) #### New Contributors - [@nol166](https://redirect.github.com/nol166) made their first contribution in [#1938](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1938) - [@cornshakes](https://redirect.github.com/cornshakes) made their first contribution in [#1946](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1946) - [@chippy01](https://redirect.github.com/chippy01) made their first contribution in [#1949](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1949) **Full Changelog**: <pi-hole/docker-pi-hole@2025.11.0...2025.11.1> ***  #### What's Changed (FTL v6.4.1) - Fix API specs and example for dns.upstreams in config.yaml by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/FTL#2696](https://redirect.github.com/pi-hole/FTL/pull/2696) - gravity update - silently discard unicode BOM if present by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/FTL#2702](https://redirect.github.com/pi-hole/FTL/pull/2702) - Update embedded SQLite to 3.51.0 by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2704](https://redirect.github.com/pi-hole/FTL/pull/2704) - Get earliest query timestamp from database by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/FTL#2706](https://redirect.github.com/pi-hole/FTL/pull/2706) - Increase buffer length for query string by [@mwoolweaver](https://redirect.github.com/mwoolweaver) in [pi-hole/FTL#2709](https://redirect.github.com/pi-hole/FTL/pull/2709) - Reduce DNS resolver locking during database interaction by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2700](https://redirect.github.com/pi-hole/FTL/pull/2700) - Make colour output optional in streaming gravity API call by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/FTL#2718](https://redirect.github.com/pi-hole/FTL/pull/2718) - api/dhcp/leases Allow for hwaddr > 48 bits by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/FTL#2724](https://redirect.github.com/pi-hole/FTL/pull/2724) - Add rate-limiting for TOTP validation by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2719](https://redirect.github.com/pi-hole/FTL/pull/2719) - Implement simple partial matching for regex in /api/search/{domain} by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2705](https://redirect.github.com/pi-hole/FTL/pull/2705) - Performance optimizations: string processing, memory management, and compiler flags by [@Copilot](https://redirect.github.com/Copilot) in [pi-hole/FTL#2571](https://redirect.github.com/pi-hole/FTL/pull/2571) - Fix authentication redirect when webhome is / (fixes [#2518](https://redirect.github.com/pi-hole/docker-pi-hole/issues/2518)) by [@averyvigolo](https://redirect.github.com/averyvigolo) in [pi-hole/FTL#2610](https://redirect.github.com/pi-hole/FTL/pull/2610) - Reduce database locking and add timing debug setting by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2688](https://redirect.github.com/pi-hole/FTL/pull/2688) #### New Contributors - [@mwoolweaver](https://redirect.github.com/mwoolweaver) made their first contribution in [pi-hole/FTL#2709](https://redirect.github.com/pi-hole/FTL/pull/2709) - [@Copilot](https://redirect.github.com/Copilot) made their first contribution in [pi-hole/FTL#2571](https://redirect.github.com/pi-hole/FTL/pull/2571) - [@averyvigolo](https://redirect.github.com/averyvigolo) made their first contribution in [pi-hole/FTL#2610](https://redirect.github.com/pi-hole/FTL/pull/2610) **Full Changelog**: <pi-hole/FTL@v6.3.3...v6.4>   #### What's Changed (Web v6.4) - Start using commented tags for editorconfig-checker by [@yubiuser](https://redirect.github.com/yubiuser) in [pi-hole/web#3643](https://redirect.github.com/pi-hole/web/pull/3643) - Remove some unused code (leftover from v5) by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/web#3636](https://redirect.github.com/pi-hole/web/pull/3636) - Make sure the table is redrawn after the dnssec API call returns by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/web#3645](https://redirect.github.com/pi-hole/web/pull/3645) - Add hint that partial matching may not return all possible results by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/web#3654](https://redirect.github.com/pi-hole/web/pull/3654) - Enable one-time code autofill for TOTP input by [@sebastianlivoni](https://redirect.github.com/sebastianlivoni) in [pi-hole/web#3658](https://redirect.github.com/pi-hole/web/pull/3658) - Set "All Time " range for query log datepicker based on Database ranges (moment) by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3657](https://redirect.github.com/pi-hole/web/pull/3657) - Request ANSI colour codes when calling gravity API by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3662](https://redirect.github.com/pi-hole/web/pull/3662) - Pi-hole Web v6.4 by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3670](https://redirect.github.com/pi-hole/web/pull/3670) #### New Contributors - [@sebastianlivoni](https://redirect.github.com/sebastianlivoni) made their first contribution in [pi-hole/web#3658](https://redirect.github.com/pi-hole/web/pull/3658) **Full Changelog**: <pi-hole/web@v6.3...v6.4> #### What's Changed (Core v6.3) - Add Fedora 43 to test suite by [@yubiuser](https://redirect.github.com/yubiuser) in [pi-hole/pi-hole#6453](https://redirect.github.com/pi-hole/pi-hole/pull/6453) - Fix libcap capabilities not being granted on OpenRC distros by [@Sparronator9999](https://redirect.github.com/Sparronator9999) in [pi-hole/pi-hole#6456](https://redirect.github.com/pi-hole/pi-hole/pull/6456) - systemd service - don't use deprecated PermissionsStartOnly by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/pi-hole#6465](https://redirect.github.com/pi-hole/pi-hole/pull/6465) - debug - speed up processing and display of file contents and services by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/pi-hole#6469](https://redirect.github.com/pi-hole/pi-hole/pull/6469) - Use port from dns.port in piholeDebug.sh by [@darkexplosiveqwx](https://redirect.github.com/darkexplosiveqwx) in [pi-hole/pi-hole#6475](https://redirect.github.com/pi-hole/pi-hole/pull/6475) - Improve gravity tables presentation on the debug log by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/pi-hole#6460](https://redirect.github.com/pi-hole/pi-hole/pull/6460) #### New Contributors - [@Sparronator9999](https://redirect.github.com/Sparronator9999) made their first contribution in [pi-hole/pi-hole#6456](https://redirect.github.com/pi-hole/pi-hole/pull/6456) **Full Changelog**: <pi-hole/pi-hole@v6.2.2...v6.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/bigbeartechworld/big-bear-universal-apps).

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [jacklul/pihole](https://redirect.github.com/pi-hole/docker-pi-hole) | patch | `2025.11.0` -> `2025.11.1` | --- ### Release Notes <details> <summary>pi-hole/docker-pi-hole (jacklul/pihole)</summary> ### [`v2025.11.1`](https://redirect.github.com/pi-hole/docker-pi-hole/releases/tag/2025.11.1) [Compare Source](https://redirect.github.com/pi-hole/docker-pi-hole/compare/2025.11.0...2025.11.1)  #### What's Changed (Docker Specific) - Fix build status badge in readme by [@nol166](https://redirect.github.com/nol166) in [#1938](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1938) - Add RISCV back by [@yubiuser](https://redirect.github.com/yubiuser) in [#1939](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1939) - Improve FTL startup detection and log tailing by [@PromoFaux](https://redirect.github.com/PromoFaux) in [#1940](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1940) - Set DNS listening mode to 'ALL' in docker-compose.yml example by [@cornshakes](https://redirect.github.com/cornshakes) in [#1946](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1946) - Add instructions for excluding Pi-hole from Watchtower updates by [@chippy01](https://redirect.github.com/chippy01) in [#1949](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1949) #### New Contributors - [@nol166](https://redirect.github.com/nol166) made their first contribution in [#1938](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1938) - [@cornshakes](https://redirect.github.com/cornshakes) made their first contribution in [#1946](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1946) - [@chippy01](https://redirect.github.com/chippy01) made their first contribution in [#1949](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1949) **Full Changelog**: <pi-hole/docker-pi-hole@2025.11.0...2025.11.1> ***  #### What's Changed (FTL v6.4.1) - Fix API specs and example for dns.upstreams in config.yaml by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/FTL#2696](https://redirect.github.com/pi-hole/FTL/pull/2696) - gravity update - silently discard unicode BOM if present by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/FTL#2702](https://redirect.github.com/pi-hole/FTL/pull/2702) - Update embedded SQLite to 3.51.0 by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2704](https://redirect.github.com/pi-hole/FTL/pull/2704) - Get earliest query timestamp from database by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/FTL#2706](https://redirect.github.com/pi-hole/FTL/pull/2706) - Increase buffer length for query string by [@mwoolweaver](https://redirect.github.com/mwoolweaver) in [pi-hole/FTL#2709](https://redirect.github.com/pi-hole/FTL/pull/2709) - Reduce DNS resolver locking during database interaction by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2700](https://redirect.github.com/pi-hole/FTL/pull/2700) - Make colour output optional in streaming gravity API call by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/FTL#2718](https://redirect.github.com/pi-hole/FTL/pull/2718) - api/dhcp/leases Allow for hwaddr > 48 bits by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/FTL#2724](https://redirect.github.com/pi-hole/FTL/pull/2724) - Add rate-limiting for TOTP validation by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2719](https://redirect.github.com/pi-hole/FTL/pull/2719) - Implement simple partial matching for regex in /api/search/{domain} by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2705](https://redirect.github.com/pi-hole/FTL/pull/2705) - Performance optimizations: string processing, memory management, and compiler flags by [@Copilot](https://redirect.github.com/Copilot) in [pi-hole/FTL#2571](https://redirect.github.com/pi-hole/FTL/pull/2571) - Fix authentication redirect when webhome is / (fixes [#2518](https://redirect.github.com/pi-hole/docker-pi-hole/issues/2518)) by [@averyvigolo](https://redirect.github.com/averyvigolo) in [pi-hole/FTL#2610](https://redirect.github.com/pi-hole/FTL/pull/2610) - Reduce database locking and add timing debug setting by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2688](https://redirect.github.com/pi-hole/FTL/pull/2688) #### New Contributors - [@mwoolweaver](https://redirect.github.com/mwoolweaver) made their first contribution in [pi-hole/FTL#2709](https://redirect.github.com/pi-hole/FTL/pull/2709) - [@Copilot](https://redirect.github.com/Copilot) made their first contribution in [pi-hole/FTL#2571](https://redirect.github.com/pi-hole/FTL/pull/2571) - [@averyvigolo](https://redirect.github.com/averyvigolo) made their first contribution in [pi-hole/FTL#2610](https://redirect.github.com/pi-hole/FTL/pull/2610) **Full Changelog**: <pi-hole/FTL@v6.3.3...v6.4>   #### What's Changed (Web v6.4) - Start using commented tags for editorconfig-checker by [@yubiuser](https://redirect.github.com/yubiuser) in [pi-hole/web#3643](https://redirect.github.com/pi-hole/web/pull/3643) - Remove some unused code (leftover from v5) by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/web#3636](https://redirect.github.com/pi-hole/web/pull/3636) - Make sure the table is redrawn after the dnssec API call returns by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/web#3645](https://redirect.github.com/pi-hole/web/pull/3645) - Add hint that partial matching may not return all possible results by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/web#3654](https://redirect.github.com/pi-hole/web/pull/3654) - Enable one-time code autofill for TOTP input by [@sebastianlivoni](https://redirect.github.com/sebastianlivoni) in [pi-hole/web#3658](https://redirect.github.com/pi-hole/web/pull/3658) - Set "All Time " range for query log datepicker based on Database ranges (moment) by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3657](https://redirect.github.com/pi-hole/web/pull/3657) - Request ANSI colour codes when calling gravity API by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3662](https://redirect.github.com/pi-hole/web/pull/3662) - Pi-hole Web v6.4 by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3670](https://redirect.github.com/pi-hole/web/pull/3670) #### New Contributors - [@sebastianlivoni](https://redirect.github.com/sebastianlivoni) made their first contribution in [pi-hole/web#3658](https://redirect.github.com/pi-hole/web/pull/3658) **Full Changelog**: <pi-hole/web@v6.3...v6.4> #### What's Changed (Core v6.3) - Add Fedora 43 to test suite by [@yubiuser](https://redirect.github.com/yubiuser) in [pi-hole/pi-hole#6453](https://redirect.github.com/pi-hole/pi-hole/pull/6453) - Fix libcap capabilities not being granted on OpenRC distros by [@Sparronator9999](https://redirect.github.com/Sparronator9999) in [pi-hole/pi-hole#6456](https://redirect.github.com/pi-hole/pi-hole/pull/6456) - systemd service - don't use deprecated PermissionsStartOnly by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/pi-hole#6465](https://redirect.github.com/pi-hole/pi-hole/pull/6465) - debug - speed up processing and display of file contents and services by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/pi-hole#6469](https://redirect.github.com/pi-hole/pi-hole/pull/6469) - Use port from dns.port in piholeDebug.sh by [@darkexplosiveqwx](https://redirect.github.com/darkexplosiveqwx) in [pi-hole/pi-hole#6475](https://redirect.github.com/pi-hole/pi-hole/pull/6475) - Improve gravity tables presentation on the debug log by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/pi-hole#6460](https://redirect.github.com/pi-hole/pi-hole/pull/6460) #### New Contributors - [@Sparronator9999](https://redirect.github.com/Sparronator9999) made their first contribution in [pi-hole/pi-hole#6456](https://redirect.github.com/pi-hole/pi-hole/pull/6456) **Full Changelog**: <pi-hole/pi-hole@v6.2.2...v6.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/bigbeartechworld/big-bear-universal-apps).

…ag to v2025.11.1 This PR contains the following updates: | Package | Update | Change | |---|---|---| | [bigbeartechworld/big-bear-pihole-unbound](https://redirect.github.com/pi-hole/docker-pi-hole) | patch | `2025.11.0` → `2025.11.1` | --- ### Release Notes <details> <summary>pi-hole/docker-pi-hole (bigbeartechworld/big-bear-pihole-unbound)</summary> ### [`v2025.11.1`](https://redirect.github.com/pi-hole/docker-pi-hole/releases/tag/2025.11.1) [Compare Source](https://redirect.github.com/pi-hole/docker-pi-hole/compare/2025.11.0...2025.11.1)  ##### What's Changed (Docker Specific) - Fix build status badge in readme by [@nol166](https://redirect.github.com/nol166) in [#1938](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1938) - Add RISCV back by [@yubiuser](https://redirect.github.com/yubiuser) in [#1939](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1939) - Improve FTL startup detection and log tailing by [@PromoFaux](https://redirect.github.com/PromoFaux) in [#1940](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1940) - Set DNS listening mode to 'ALL' in docker-compose.yml example by [@cornshakes](https://redirect.github.com/cornshakes) in [#1946](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1946) - Add instructions for excluding Pi-hole from Watchtower updates by [@chippy01](https://redirect.github.com/chippy01) in [#1949](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1949) ##### New Contributors - [@nol166](https://redirect.github.com/nol166) made their first contribution in [#1938](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1938) - [@cornshakes](https://redirect.github.com/cornshakes) made their first contribution in [#1946](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1946) - [@chippy01](https://redirect.github.com/chippy01) made their first contribution in [#1949](https://redirect.github.com/pi-hole/docker-pi-hole/pull/1949) **Full Changelog**: <pi-hole/docker-pi-hole@2025.11.0...2025.11.1> ***  ##### What's Changed (FTL v6.4.1) - Fix API specs and example for dns.upstreams in config.yaml by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/FTL#2696](https://redirect.github.com/pi-hole/FTL/pull/2696) - gravity update - silently discard unicode BOM if present by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/FTL#2702](https://redirect.github.com/pi-hole/FTL/pull/2702) - Update embedded SQLite to 3.51.0 by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2704](https://redirect.github.com/pi-hole/FTL/pull/2704) - Get earliest query timestamp from database by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/FTL#2706](https://redirect.github.com/pi-hole/FTL/pull/2706) - Increase buffer length for query string by [@mwoolweaver](https://redirect.github.com/mwoolweaver) in [pi-hole/FTL#2709](https://redirect.github.com/pi-hole/FTL/pull/2709) - Reduce DNS resolver locking during database interaction by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2700](https://redirect.github.com/pi-hole/FTL/pull/2700) - Make colour output optional in streaming gravity API call by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/FTL#2718](https://redirect.github.com/pi-hole/FTL/pull/2718) - api/dhcp/leases Allow for hwaddr > 48 bits by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/FTL#2724](https://redirect.github.com/pi-hole/FTL/pull/2724) - Add rate-limiting for TOTP validation by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2719](https://redirect.github.com/pi-hole/FTL/pull/2719) - Implement simple partial matching for regex in /api/search/{domain} by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2705](https://redirect.github.com/pi-hole/FTL/pull/2705) - Performance optimizations: string processing, memory management, and compiler flags by [@Copilot](https://redirect.github.com/Copilot) in [pi-hole/FTL#2571](https://redirect.github.com/pi-hole/FTL/pull/2571) - Fix authentication redirect when webhome is / (fixes [#2518](https://redirect.github.com/pi-hole/docker-pi-hole/issues/2518)) by [@averyvigolo](https://redirect.github.com/averyvigolo) in [pi-hole/FTL#2610](https://redirect.github.com/pi-hole/FTL/pull/2610) - Reduce database locking and add timing debug setting by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/FTL#2688](https://redirect.github.com/pi-hole/FTL/pull/2688) ##### New Contributors - [@mwoolweaver](https://redirect.github.com/mwoolweaver) made their first contribution in [pi-hole/FTL#2709](https://redirect.github.com/pi-hole/FTL/pull/2709) - [@Copilot](https://redirect.github.com/Copilot) made their first contribution in [pi-hole/FTL#2571](https://redirect.github.com/pi-hole/FTL/pull/2571) - [@averyvigolo](https://redirect.github.com/averyvigolo) made their first contribution in [pi-hole/FTL#2610](https://redirect.github.com/pi-hole/FTL/pull/2610) **Full Changelog**: <pi-hole/FTL@v6.3.3...v6.4>   ##### What's Changed (Web v6.4) - Start using commented tags for editorconfig-checker by [@yubiuser](https://redirect.github.com/yubiuser) in [pi-hole/web#3643](https://redirect.github.com/pi-hole/web/pull/3643) - Remove some unused code (leftover from v5) by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/web#3636](https://redirect.github.com/pi-hole/web/pull/3636) - Make sure the table is redrawn after the dnssec API call returns by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/web#3645](https://redirect.github.com/pi-hole/web/pull/3645) - Add hint that partial matching may not return all possible results by [@DL6ER](https://redirect.github.com/DL6ER) in [pi-hole/web#3654](https://redirect.github.com/pi-hole/web/pull/3654) - Enable one-time code autofill for TOTP input by [@sebastianlivoni](https://redirect.github.com/sebastianlivoni) in [pi-hole/web#3658](https://redirect.github.com/pi-hole/web/pull/3658) - Set "All Time " range for query log datepicker based on Database ranges (moment) by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3657](https://redirect.github.com/pi-hole/web/pull/3657) - Request ANSI colour codes when calling gravity API by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3662](https://redirect.github.com/pi-hole/web/pull/3662) - Pi-hole Web v6.4 by [@PromoFaux](https://redirect.github.com/PromoFaux) in [pi-hole/web#3670](https://redirect.github.com/pi-hole/web/pull/3670) ##### New Contributors - [@sebastianlivoni](https://redirect.github.com/sebastianlivoni) made their first contribution in [pi-hole/web#3658](https://redirect.github.com/pi-hole/web/pull/3658) **Full Changelog**: <pi-hole/web@v6.3...v6.4> ##### What's Changed (Core v6.3) - Add Fedora 43 to test suite by [@yubiuser](https://redirect.github.com/yubiuser) in [pi-hole/pi-hole#6453](https://redirect.github.com/pi-hole/pi-hole/pull/6453) - Fix libcap capabilities not being granted on OpenRC distros by [@Sparronator9999](https://redirect.github.com/Sparronator9999) in [pi-hole/pi-hole#6456](https://redirect.github.com/pi-hole/pi-hole/pull/6456) - systemd service - don't use deprecated PermissionsStartOnly by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/pi-hole#6465](https://redirect.github.com/pi-hole/pi-hole/pull/6465) - debug - speed up processing and display of file contents and services by [@rrobgill](https://redirect.github.com/rrobgill) in [pi-hole/pi-hole#6469](https://redirect.github.com/pi-hole/pi-hole/pull/6469) - Use port from dns.port in piholeDebug.sh by [@darkexplosiveqwx](https://redirect.github.com/darkexplosiveqwx) in [pi-hole/pi-hole#6475](https://redirect.github.com/pi-hole/pi-hole/pull/6475) - Improve gravity tables presentation on the debug log by [@rdwebdesign](https://redirect.github.com/rdwebdesign) in [pi-hole/pi-hole#6460](https://redirect.github.com/pi-hole/pi-hole/pull/6460) ##### New Contributors - [@Sparronator9999](https://redirect.github.com/Sparronator9999) made their first contribution in [pi-hole/pi-hole#6456](https://redirect.github.com/pi-hole/pi-hole/pull/6456) **Full Changelog**: <pi-hole/pi-hole@v6.2.2...v6.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/bigbeartechworld/big-bear-universal-apps).

Add rate-limiting for TOTP validation

febbdd5

Signed-off-by: Dominik <dl6er@dl6er.de>

DL6ER requested a review from a team as a code owner November 20, 2025 18:05

DL6ER added the SECURITY label Nov 20, 2025

yubiuser approved these changes Nov 20, 2025

View reviewed changes

DL6ER merged commit 38a87e9 into development Nov 25, 2025
17 checks passed

DL6ER deleted the tweak/totp-rate-limit branch November 25, 2025 18:48

PromoFaux mentioned this pull request Nov 25, 2025

Pi-hole FTL v6.4 #2726

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add rate-limiting for TOTP validation#2719

Add rate-limiting for TOTP validation#2719
DL6ER merged 1 commit into
developmentfrom
tweak/totp-rate-limit

DL6ER commented Nov 20, 2025

Uh oh!

yubiuser left a comment

Uh oh!

Uh oh!

pralor-bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

DL6ER commented Nov 20, 2025

What does this implement/fix?

Checklist:

Uh oh!

yubiuser left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pralor-bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants