0001-views-ratelimit-email-form-views-41489.patch

Valentin Deniaud, 22 avril 2020 11:06

Voir les différences: en ligne côte à côte

Subject: [PATCH] views: ratelimit email form views (#41489)

 src/authentic2/app_settings.py |  6 ++++
 src/authentic2/views.py        | 37 +++++++++++++++++++++++
 tests/settings.py              |  3 ++
 tests/test_views.py            | 55 ++++++++++++++++++++++++++++++++++
 4 files changed, 101 insertions(+)

         A2_ACCEPT_EMAIL_AUTHENTICATION=Setting(
             default=True,
             definition='Enable authentication by email'),
         A2_EMAILS_IP_RATELIMIT=Setting(
             default='10/h',
             definition='Maximum rate of email sendings triggered by the same IP address.'),
         A2_EMAILS_ADDRESS_RATELIMIT=Setting(
             default='3/d',
             definition='Maximum rate of emails sent to the same email address.'),
+    )
     app_settings = AppSettings(default_settings)

     import random
     import re
     from ratelimit.utils import is_ratelimited
     from django.conf import settings
     from django.shortcuts import render, get_object_or_404
     from django.template.loader import render_to_string
-...
             return ctx
         def form_valid(self, form):
             if is_ratelimited(self.request, key='post:email', group='pw-reset-email',
                               rate=app_settings.A2_EMAILS_ADDRESS_RATELIMIT, increment=True):
                 form.add_error(
                     'email',
                     _('Multiple emails have already been sent to this address. Further attempts are '
                       'blocked, please check your spam folder or try again later.')
+                )
                 return self.form_invalid(form)
             if is_ratelimited(self.request, key='ip', group='pw-reset-email',
                               rate=app_settings.A2_EMAILS_IP_RATELIMIT, increment=True):
                 form.add_error(
                     'email',
                     _('Multiple password reset attempts have already been made from this IP address. No '
                       'further email will be sent, please check your spam folder or try again later.')
+                )
                 return self.form_invalid(form)
             form.save()
             self.request.session['reset_email'] = form.cleaned_data['email']
             return super(PasswordResetView, self).form_valid(form)
-...
         def dispatch(self, request, *args, **kwargs):
             if not getattr(settings, 'REGISTRATION_OPEN', True):
                 raise Http404('Registration is not open.')
             self.token = {}
             self.ou = get_default_ou()
             # load pre-filled values
-...
             return super(BaseRegistrationView, self).dispatch(request, *args, **kwargs)
         def form_valid(self, form):
             if is_ratelimited(self.request, key='post:email', group='registration-email',
                               rate=app_settings.A2_EMAILS_ADDRESS_RATELIMIT, increment=True):
                 form.add_error(
                     'email',
                     _('Multiple emails have already been sent to this address. Further attempts are '
                       'blocked, please check your spam folder or try again later.')
+                )
                 return self.form_invalid(form)
             if is_ratelimited(self.request, key='ip', group='registration-email',
                               rate=app_settings.A2_EMAILS_IP_RATELIMIT, increment=True):
                 form.add_error(
                     'email',
                     _('Multiple registration attempts have already been made from this IP address. No '
                       'further email will be sent, please check your spam folder or try again later.')
+                )
                 return self.form_invalid(form)
             email = form.cleaned_data.pop('email')
             for field in form.cleaned_data:
                 self.token[field] = form.cleaned_data[field]

tests/settings.py
48	48	TEMPLATES[0]['DIRS'].append('tests/templates')
49	49
50	50	SITE_BASE_URL = 'http://localhost'
	51
	52	A2_MAX_EMAILS_PER_IP = None
	53	A2_MAX_EMAILS_FOR_ADDRESS = None

     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     # authentic2
     import datetime
     from utils import login, logout, get_link_from_mail
     import pytest
-...
         response = app.get(reverse('account_management'))
         assert response.status_code == 302
         assert response['Location'] == settings.A2_ACCOUNTS_URL
     @pytest.mark.parametrize('view_name', ['registration_register', 'password_reset'])
     def test_views_email_ratelimit(app, db, simple_user, settings, mailoutbox, freezer, view_name):
         freezer.move_to('2020-01-01')
         settings.A2_EMAILS_IP_RATELIMIT = '10/h'
         settings.A2_EMAILS_ADDRESS_RATELIMIT = '3/d'
         users = [User.objects.create(email='test%s@test.com' % i) for i in range(8)]
         # reach email limit
         for _ in range(3):
             response = app.get(reverse(view_name))
             response.form.set('email', simple_user.email)
             response = response.form.submit()
         assert len(mailoutbox) == 3
         response = app.get(reverse(view_name))
         response.form.set('email', simple_user.email)
         response = response.form.submit()
         assert len(mailoutbox) == 3
         assert 'try again later' in response.text
         # reach ip limit
         for i in range(7):
             response = app.get(reverse(view_name))
             response.form.set('email', users[i].email)
             response = response.form.submit()
         assert len(mailoutbox) == 10
         response = app.get(reverse(view_name))
         response.form.set('email', users[i + 1].email)
         response = response.form.submit()
         assert len(mailoutbox) == 10
         assert 'try again later' in response.text
         # ip ratelimits are lifted after an hour
         freezer.tick(datetime.timedelta(hours=1))
         response = app.get(reverse(view_name))
         response.form.set('email', users[0].email)
         response = response.form.submit()
         assert len(mailoutbox) == 11
         # email ratelimits are lifted after a day
         response = app.get(reverse(view_name))
         response.form.set('email', simple_user.email)
         response = response.form.submit()
         assert len(mailoutbox) == 11
         assert 'try again later' in response.text
         freezer.tick(datetime.timedelta(days=1))
         response = app.get(reverse(view_name))
         response.form.set('email', simple_user.email)
         response = response.form.submit()
         assert len(mailoutbox) == 12
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-views-ratelimit-email-form-views-41489.patch