fix(bruteforce): Don't throttle requests with failing CSRF

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Author: kesselb

core/Controller/LoginController.php

@@ -319,6 +319,7 @@ public function tryLogin(
 				// case when a user has already logged-in, in another tab.
 				return $this->generateRedirect($redirect_url);
 			}
+			$throttle = false;
 			$error = self::LOGIN_MSG_CSRFCHECKFAILED;
 		}
 

tests/Core/Controller/LoginControllerTest.php

@@ -596,7 +596,6 @@ public function testLoginWithoutPassedCsrfCheckAndNotLoggedIn(bool $rememberme):
 		$response = $this->loginController->tryLogin($loginChain, $trustedDomainHelper, 'Jane', $password, $rememberme, $originalUrl);
 
 		$expected = new RedirectResponse('');
-		$expected->throttle(['user' => 'Jane']);
 		$this->assertEquals($expected, $response);
 	}