From 7b80e4d2a5bceb611e54b52697b4ed3d550e7bb6 Mon Sep 17 00:00:00 2001
From: panda <panda_dtdyy@outlook.com>
Date: Thu, 7 Sep 2023 06:07:56 +0800
Subject: [PATCH] core: fix lostpass send mail limit (#659)

---
 packages/hydrooj/src/handler/user.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index 5b98ea23b..8ce4b64d9 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -332,6 +332,11 @@ class UserLostPassHandler extends Handler {
         if (!system.get('smtp.user')) throw new SystemError('Cannot send mail');
         const udoc = await user.getByEmail('system', mail);
         if (!udoc) throw new UserNotFoundError(mail);
+        await Promise.all([
+            this.limitRate('send_mail', 3600, 30, false),
+            this.limitRate(`user_lostpass_${mail}`, 60, 5, false),
+            oplog.log(this, 'user.lostpass', {}),
+        ]);
         const [tid] = await token.add(
             token.TYPE_LOSTPASS,
             system.get('session.unsaved_expire_seconds'),