From c342726ad4ccbb90b8ff29f1cc1c89f9f7e8d98f Mon Sep 17 00:00:00 2001
From: Yohan Boniface <yb@enix.org>
Date: Fri, 26 Apr 2019 13:48:55 +0200
Subject: [PATCH] Allow to control RATES_LIMIT from configuration (#1787)
* Allow to control RATES_LIMIT from configuration
* @Chocobozzz review (squash me)
---
config/default.yaml | 10 ++++++++++
config/production.yaml.example | 10 ++++++++++
server/initializers/checker-before-init.ts | 3 ++-
server/initializers/config.ts | 10 ++++++++++
server/initializers/constants.ts | 8 ++++----
support/docker/production/config/production.yaml | 10 ++++++++++
6 files changed, 46 insertions(+), 5 deletions(-)
diff --git a/config/default.yaml b/config/default.yaml
index 70b10299d5..f8be23d694 100644
--- a/config/default.yaml
+++ b/config/default.yaml
@@ -9,6 +9,16 @@ webserver:
hostname: 'localhost'
port: 9000
+rates_limit:
+ login:
+ # 15 attempts in 5 min
+ window: 5 minutes
+ max: 15
+ ask_send_email:
+ # 3 attempts in 5 min
+ window: 5 minutes
+ max: 3
+
# Proxies to trust to get real client IP
# If you run PeerTube just behind a local proxy (nginx), keep 'loopback'
# If you run PeerTube behind a remote proxy, add the proxy IP address (or subnet)
diff --git a/config/production.yaml.example b/config/production.yaml.example
index 06baaf7d49..f1f0f12d12 100644
--- a/config/production.yaml.example
+++ b/config/production.yaml.example
@@ -8,6 +8,16 @@ webserver:
hostname: 'example.com'
port: 443
+rates_limit:
+ login:
+ # 15 attempts in 5 min
+ window: 5 minutes
+ max: 15
+ ask_send_email:
+ # 3 attempts in 5 min
+ window: 5 minutes
+ max: 3
+
# Proxies to trust to get real client IP
# If you run PeerTube just behind a local proxy (nginx), keep 'loopback'
# If you run PeerTube behind a remote proxy, add the proxy IP address (or subnet)
diff --git a/server/initializers/checker-before-init.ts b/server/initializers/checker-before-init.ts
index 223ef8078e..622ad7d6b1 100644
--- a/server/initializers/checker-before-init.ts
+++ b/server/initializers/checker-before-init.ts
@@ -27,7 +27,8 @@ function checkMissedConfig () {
'services.twitter.username', 'services.twitter.whitelisted',
'followers.instance.enabled', 'followers.instance.manual_approval',
'tracker.enabled', 'tracker.private', 'tracker.reject_too_many_announces',
- 'history.videos.max_age', 'views.videos.remote.max_age'
+ 'history.videos.max_age', 'views.videos.remote.max_age',
+ 'rates_limit.login.window', 'rates_limit.login.max', 'rates_limit.ask_send_email.window', 'rates_limit.ask_send_email.max'
]
const requiredAlternatives = [
[ // set
diff --git a/server/initializers/config.ts b/server/initializers/config.ts
index baf5023054..4f77e144d0 100644
--- a/server/initializers/config.ts
+++ b/server/initializers/config.ts
@@ -63,6 +63,16 @@ const CONFIG = {
HOSTNAME: config.get<string>('webserver.hostname'),
PORT: config.get<number>('webserver.port')
},
+ RATES_LIMIT: {
+ LOGIN: {
+ WINDOW_MS: parseDurationToMs(config.get<string>('rates_limit.login.window')),
+ MAX: config.get<number>('rates_limit.login.max')
+ },
+ ASK_SEND_EMAIL: {
+ WINDOW_MS: parseDurationToMs(config.get<string>('rates_limit.ask_send_email.window')),
+ MAX: config.get<number>('rates_limit.ask_send_email.max')
+ }
+ },
TRUST_PROXY: config.get<string[]>('trust_proxy'),
LOG: {
LEVEL: config.get<string>('log.level')
diff --git a/server/initializers/constants.ts b/server/initializers/constants.ts
index 2be364cc8e..193bae5b50 100644
--- a/server/initializers/constants.ts
+++ b/server/initializers/constants.ts
@@ -281,12 +281,12 @@ let CONSTRAINTS_FIELDS = {
const RATES_LIMIT = {
LOGIN: {
- WINDOW_MS: 5 * 60 * 1000, // 5 minutes
- MAX: 15 // 15 attempts
+ WINDOW_MS: CONFIG.RATES_LIMIT.LOGIN.WINDOW_MS,
+ MAX: CONFIG.RATES_LIMIT.LOGIN.MAX
},
ASK_SEND_EMAIL: {
- WINDOW_MS: 5 * 60 * 1000, // 5 minutes
- MAX: 3 // 3 attempts
+ WINDOW_MS: CONFIG.RATES_LIMIT.ASK_SEND_EMAIL.WINDOW_MS,
+ MAX: CONFIG.RATES_LIMIT.ASK_SEND_EMAIL.MAX
}
}
diff --git a/support/docker/production/config/production.yaml b/support/docker/production/config/production.yaml
index d585cd73ea..ae6bf3982b 100644
--- a/support/docker/production/config/production.yaml
+++ b/support/docker/production/config/production.yaml
@@ -8,6 +8,16 @@ webserver:
hostname: undefined
port: 443
+rates_limit:
+ login:
+ # 15 attempts in 5 min
+ window: 5 minutes
+ max: 15
+ ask_send_email:
+ # 3 attempts in 5 min
+ window: 5 minutes
+ max: 3
+
# Proxies to trust to get real client IP
# If you run PeerTube just behind a local proxy (nginx), keep 'loopback'
# If you run PeerTube behind a remote proxy, add the proxy IP address (or subnet)
--
GitLab