CVE-2023-2666: Froxlor vulnerable to Allocation of Resources Without Limits or Throttling

The vulnerability stems from missing rate-limiting in HTTP request handling, specifically affecting the password reset page. The commit introduced RateLimiter::run() in critical entry points like general initialization (init.php), API endpoints (Api.php), and installation scripts. In vulnerable versions (<2.0.16), these entry points lacked the RateLimiter check, allowing unlimited requests. The functions above represent the core points where rate-limiting was enforced post-patch, implying their absence in prior versions directly caused the vulnerability. The password reset functionality itself is likely handled through these general HTTP/API pathways, making these functions the root of the issue.