Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

core: add strict register rate limit (#663)

Browse Source
This commit is contained in:
panda authored and GitHub committed 2023-09-29 19:39:07 +08:00
1 parent 9bceee8507
commit 659bd9f4aa
1 file changed
+7 -2
Download Patch File Download Diff File Expand all files Collapse all files
packages/hydrooj/src/handler/user.ts
+7 -2
View File
@@ -243,6 +243,7 @@ export class UserRegisterHandler extends Handler {
const mailDomain = mail.split('@')[1]; const mailDomain = mail.split('@')[1];
if (await BlackListModel.get(`mail::${mailDomain}`)) throw new BlacklistedError(mailDomain); if (await BlackListModel.get(`mail::${mailDomain}`)) throw new BlacklistedError(mailDomain);
await Promise.all([ await Promise.all([
this.limitRate(`send_mail_${mail}`, 60, 3, false),
this.limitRate('send_mail', 3600, 30, false), this.limitRate('send_mail', 3600, 30, false),
oplog.log(this, 'user.register', {}), oplog.log(this, 'user.register', {}),
]); ]);
@@ -265,7 +266,11 @@ export class UserRegisterHandler extends Handler {
} else this.response.redirect = this.url('user_register_with_code', { code: t[0] }); } else this.response.redirect = this.url('user_register_with_code', { code: t[0] });
} else if (phoneNumber) { } else if (phoneNumber) {
if (!global.Hydro.lib.sendSms) throw new SystemError('Cannot send sms'); if (!global.Hydro.lib.sendSms) throw new SystemError('Cannot send sms');
await this.limitRate('send_sms', 60, 3); await Promise.all([
this.limitRate(`send_sms_${phoneNumber}`, 60, 1, false),
this.limitRate('send_sms', 3600, 15, false),
oplog.log(this, 'user.register', {}),
]);
const id = String.random(6, '0123456789'); const id = String.random(6, '0123456789');
await token.add( await token.add(
token.TYPE_REGISTRATION, token.TYPE_REGISTRATION,
@@ -334,7 +339,7 @@ class UserLostPassHandler extends Handler {
if (!udoc) throw new UserNotFoundError(mail); if (!udoc) throw new UserNotFoundError(mail);
await Promise.all([ await Promise.all([
this.limitRate('send_mail', 3600, 30, false), this.limitRate('send_mail', 3600, 30, false),
this.limitRate(`user_lostpass_${mail}`, 60, 5, false), this.limitRate(`user_lostpass_${mail}`, 60, 3, false),
oplog.log(this, 'user.lostpass', {}), oplog.log(this, 'user.lostpass', {}),
]); ]);
const [tid] = await token.add( const [tid] = await token.add(