Skip turnstile logic entirely if challenge is not possible

maccabeelevine · Dec 5, 2024 · 4168916 · 4168916
1 parent 5113d43
commit 4168916
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/module/VuFind/src/VuFind/RateLimiter/RateLimiterManager.php b/module/VuFind/src/VuFind/RateLimiter/RateLimiterManager.php
@@ -151,7 +151,8 @@ public function check(EventInterface $event): array
             $limit = $limiter->consume(1);
             if (
                 $limit->isAccepted() &&
-                ($this->config['Policies'][$policyId]['turnstileRateLimiterSettings'] ?? false)
+                ($this->config['Policies'][$policyId]['turnstileRateLimiterSettings'] ?? false) &&
+                $this->turnstile->isChallengeAllowed($event)
             ) {
                 $turnstileLimiter = ($this->rateLimiterFactoryCallback)(
                     $this->config,
@@ -192,8 +193,7 @@ public function check(EventInterface $event): array
                 if (!$priorTurnstileResult) {
                     $result['allow'] = false;
                     $result['message'] = $this->getTooManyRequestsResponseMessage($event, $result);
-                    $result['presentTurnstileChallenge'] =
-                        ($priorTurnstileResult === null) && $this->turnstile->isChallengeAllowed($event);
+                    $result['presentTurnstileChallenge'] = ($priorTurnstileResult === null);
                     return $result;
                 }
             }

diff --git a/module/VuFind/src/VuFind/RateLimiter/Turnstile/Turnstile.php b/module/VuFind/src/VuFind/RateLimiter/Turnstile/Turnstile.php
@@ -73,7 +73,7 @@ public function isChallengeAllowed($event)
     {
         $routeMatch = $event->getRouteMatch();
         $controller = $routeMatch?->getParam('controller') ?? '??';
-        if ('AJAX' === $controller || str_contains($controller, 'Api')) {
+        if ('AJAX' === $controller || 'Cover' === $controller || str_contains($controller, 'Api')) {
             return false;
         }
         return true;