Fix anti-bruteforcing sleep to be outside of any locking

src/controller/controller_api.cpp

@@ -409,12 +409,15 @@ int Controller::handleAPIConnection(Socket::Connection &conn){
         }
         if (authorized){
           handleAPICommands(Request, Response);
-        }else{// unauthorized
+          Controller::checkServerLimits(); /*LTS*/
-          Util::sleep(1000); // sleep a second to prevent bruteforcing
+        }
+      }// config mutex lock
+      if (!authorized){
+        // sleep a second to prevent bruteforcing.
+        // We need to make sure this happens _after_ unlocking the mutex!
+        Util::sleep(1000);
         logins++;
       }
-        Controller::checkServerLimits(); /*LTS*/
-      }// config mutex lock
       // send the response, either normally or through JSONP callback.
       std::string jsonp = "";
       if (H.GetVar("callback") != ""){jsonp = H.GetVar("callback");}