mirrors/calibre-web
1
0
Fork 0
mirror of https://github.com/janeczku/calibre-web synced 2024-12-26 10:00:37 +00:00
Code Issues Releases Wiki Activity

Rate limit prepared for feedback on login route

Browse Source
This commit is contained in:
Ozzie Isaacs 2022-07-18 10:59:54 +02:00
parent 7344ef353c
commit ae3e3559b8
1 changed files with 85 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
cps/web.py
View File

@ -1269,27 +1269,54 @@ def register():
register_user_with_oauth() register_user_with_oauth()
return render_title_template('register.html', config=config, title=_("Register"), page="register") return render_title_template('register.html', config=config, title=_("Register"), page="register")
def handle_login_user(user, remember, message, category): def handle_login_user(user, remember, message, category):
login_user(user, remember=remember) login_user(user, remember=remember)
ub.store_user_session() ub.store_user_session()
flash(message, category=category) flash(message, category=category)
try:
limiter.check()
except RateLimitExceeded:
[limiter.limiter.storage.clear(k.key) for k in limiter.current_limits] [limiter.limiter.storage.clear(k.key) for k in limiter.current_limits]
return redirect_back(url_for("web.index")) return redirect_back(url_for("web.index"))
def error_logi():
flash(_(u"Wait one minute"), category="error")
return render_login()
@web.route('/login', methods=['GET', 'POST']) def render_login():
@limiter.limit("40/day", key_func=lambda: request.form.get('username'), per_method=["POST"]) next_url = request.args.get('next', default=url_for("web.index"), type=str)
@limiter.limit("2/minute", key_func=lambda: request.form.get('username'), per_method=["POST"]) if url_for("web.logout") == next_url:
next_url = url_for("web.index")
return render_title_template('login.html',
title=_(u"Login"),
next_url=next_url,
config=config,
oauth_check=oauth_check,
mail=config.get_mail_server_configured(), page="login")
@web.route('/login', methods=['GET'])
def login(): def login():
if current_user is not None and current_user.is_authenticated: if current_user is not None and current_user.is_authenticated:
return redirect(url_for('web.index')) return redirect(url_for('web.index'))
if config.config_login_type == constants.LOGIN_LDAP and not services.ldap: if config.config_login_type == constants.LOGIN_LDAP and not services.ldap:
log.error(u"Cannot activate LDAP authentication") log.error(u"Cannot activate LDAP authentication")
flash(_(u"Cannot activate LDAP authentication"), category="error") flash(_(u"Cannot activate LDAP authentication"), category="error")
if request.method == "POST": return render_login()
@web.route('/login', methods=['POST'])
@limiter.limit("40/day", key_func=lambda: request.form.get('username', "").strip().lower())
@limiter.limit("2/minute", key_func=lambda: request.form.get('username', "").strip().lower())
def login_post():
try:
limiter.check()
except RateLimitExceeded:
flash(_(u"Wait one minute"), category="error")
return render_login()
if current_user is not None and current_user.is_authenticated:
return redirect(url_for('web.index'))
if config.config_login_type == constants.LOGIN_LDAP and not services.ldap:
log.error(u"Cannot activate LDAP authentication")
flash(_(u"Cannot activate LDAP authentication"), category="error")
form = request.form.to_dict() form = request.form.to_dict()
user = ub.session.query(ub.User).filter(func.lower(ub.User.name) == form.get('username', "").strip().lower()) \ user = ub.session.query(ub.User).filter(func.lower(ub.User.name) == form.get('username', "").strip().lower()) \
.first() .first()
@ -1342,22 +1369,7 @@ def login():
else: else:
log.warning('Login failed for user "{}" IP-address: {}'.format(form['username'], ip_address)) log.warning('Login failed for user "{}" IP-address: {}'.format(form['username'], ip_address))
flash(_(u"Wrong Username or Password"), category="error") flash(_(u"Wrong Username or Password"), category="error")
return render_login()
next_url = request.args.get('next', default=url_for("web.index"), type=str)
if url_for("web.logout") == next_url:
next_url = url_for("web.index")
# Check rate limit and prevent displaying remaining flash messages from last attempt
try:
limiter.check()
except RateLimitExceeded:
flask_session['_flashes'].clear()
raise
return render_title_template('login.html',
title=_(u"Login"),
next_url=next_url,
config=config,
oauth_check=oauth_check,
mail=config.get_mail_server_configured(), page="login")
@web.route('/logout') @web.route('/logout')