[1.x] Fix Throttle Bypass Exploit

composer.json

@@ -17,7 +17,7 @@
         "php": "^7.3|^8.0",
         "ext-json": "*",
         "bacon/bacon-qr-code": "^2.0",
-        "illuminate/support": "^8.0|^9.0",
+        "illuminate/support": "^8.82|^9.0",
         "pragmarx/google2fa": "^7.0|^8.0"
     },
     "require-dev": {

src/LoginRateLimiter.php

@@ -89,6 +89,6 @@ public function clear(Request $request)
      */
     protected function throttleKey(Request $request)
     {
-        return Str::lower($request->input(Fortify::username())).'|'.$request->ip();
+        return Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
     }
 }

tests/AuthenticatedSessionControllerTest.php

@@ -2,8 +2,10 @@
 
 namespace Laravel\Fortify\Tests;
 
+use Illuminate\Cache\RateLimiter;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Foundation\Auth\User;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Schema;
@@ -143,6 +145,40 @@ public function test_login_attempts_are_throttled()
         $response->assertJsonValidationErrors(['email']);
     }
 
+    /**
+     * @dataProvider usernameProvider
+     */
+    public function test_cant_bypass_throttle_with_special_characters(string $username, string $expectedResult)
+    {
+        $loginRateLimiter = new LoginRateLimiter(
+            $this->mock(RateLimiter::class)
+        );
+
+        $reflection = new \ReflectionClass($loginRateLimiter);
+        $method = $reflection->getMethod('throttleKey');
+        $method->setAccessible(true);
+
+        $request = $this->mock(
+            Request::class,
+            static function ($mock) use ($username) {
+                $mock->shouldReceive('input')->andReturn($username);
+                $mock->shouldReceive('ip')->andReturn('192.168.0.1');
+            }
+        );
+
+        self::assertSame($expectedResult.'|192.168.0.1', $method->invoke($loginRateLimiter, $request));
+    }
+
+    public function usernameProvider(): array
+    {
+        return [
+            'lowercase special characters' => ['ⓣⓔⓢⓣ@ⓛⓐⓡⓐⓥⓔⓛ.ⓒⓞⓜ', '[email protected]'],
+            'uppercase special characters' => ['ⓉⒺⓈⓉ@ⓁⒶⓇⒶⓋⒺⓁ.ⒸⓄⓂ', '[email protected]'],
+            'special character numbers' =>['test⑩⓸③@laravel.com', '[email protected]'],
+            'default email' => ['[email protected]', '[email protected]'],
+        ];
+    }
+
     public function test_the_user_can_logout_of_the_application()
     {
         Auth::guard()->setUser(