From 7728ee587ccb9853036b86ba18a41d0e6429f2dd Mon Sep 17 00:00:00 2001 From: Deimos Date: Thu, 25 Jul 2019 17:30:22 -0600 Subject: [PATCH] Add rate-limiting to donate endpoint Someone has been spamming the donation form to test credit card info lately, with a bunch of $1 charges that almost all get rejected by Stripe. They don't seem to change IP addresses most of the time, so this should make a little harder for them to do, anyway. --- tildes/tildes/lib/ratelimit.py | 1 + tildes/tildes/views/donate.py | 3 +++ 2 files changed, 4 insertions(+) diff --git a/tildes/tildes/lib/ratelimit.py b/tildes/tildes/lib/ratelimit.py index f5572f6..e781027 100644 --- a/tildes/tildes/lib/ratelimit.py +++ b/tildes/tildes/lib/ratelimit.py @@ -281,6 +281,7 @@ class RateLimitedAction: # the actual list of actions with rate-limit restrictions # each action must have a unique name to prevent key collisions _RATE_LIMITED_ACTIONS = ( + RateLimitedAction("donate", timedelta(hours=1), 5, max_burst=5, by_user=False), RateLimitedAction("login", timedelta(hours=1), 20), RateLimitedAction("login_two_factor", timedelta(hours=1), 20), RateLimitedAction("register", timedelta(hours=1), 50), diff --git a/tildes/tildes/views/donate.py b/tildes/tildes/views/donate.py index fe74fd7..848de25 100644 --- a/tildes/tildes/views/donate.py +++ b/tildes/tildes/views/donate.py @@ -12,6 +12,8 @@ from pyramid.security import NO_PERMISSION_REQUIRED from pyramid.view import view_config from webargs.pyramidparser import use_kwargs +from tildes.views.decorators import rate_limit_view + @view_config( route_name="donate_stripe", @@ -28,6 +30,7 @@ from webargs.pyramidparser import use_kwargs "currency": String(required=True, validate=OneOf(("CAD", "USD"))), } ) +@rate_limit_view("donate") def post_donate_stripe( request: Request, stripe_token: str, donator_email: str, amount: int, currency: str ) -> dict: