DEV: Remove Discourse.redis.delete_prefixed (#22103)

This method is a huge footgun in production, since it calls
the Redis KEYS command. From the Redis documentation at
https://redis.io/commands/keys/:

> Warning: consider KEYS as a command that should only be used in
production environments with extreme care. It may ruin performance when
it is executed against large databases. This command is intended for
debugging and special operations, such as changing your keyspace layout.
Don't use KEYS in your regular application code.

Since we were only using `delete_prefixed` in specs (now that we
removed the usage in production in 24ec06ff85)
we can remove this and instead rely on `use_redis_snapshotting` on the
particular tests that need this kind of clearing functionality.
This commit is contained in:
Martin Brennan
2023-06-16 12:44:35 +10:00
committed by GitHub
parent e89c70643b
commit 9174716737
24 changed files with 225 additions and 224 deletions

View File

@@ -2350,10 +2350,12 @@ RSpec.describe SessionController do
end
context "when rate limited" do
before { RateLimiter.enable }
use_redis_snapshotting
it "rate limits login" do
SiteSetting.max_logins_per_ip_per_hour = 2
RateLimiter.enable
RateLimiter.clear_all!
EmailToken.confirm(email_token.token)
2.times do
@@ -2371,9 +2373,6 @@ RSpec.describe SessionController do
end
it "rate limits second factor attempts by IP" do
RateLimiter.enable
RateLimiter.clear_all!
6.times do |x|
post "/session.json",
params: {
@@ -2400,8 +2399,6 @@ RSpec.describe SessionController do
end
it "rate limits second factor attempts by login" do
RateLimiter.enable
RateLimiter.clear_all!
EmailToken.confirm(email_token.token)
6.times do |x|
@@ -2644,44 +2641,47 @@ RSpec.describe SessionController do
)
end
it "should correctly rate limits" do
RateLimiter.enable
RateLimiter.clear_all!
describe "rate limiting" do
before { RateLimiter.enable }
user = Fabricate(:user)
use_redis_snapshotting
it "should correctly rate limits" do
user = Fabricate(:user)
3.times do
post "/session/forgot_password.json", params: { login: user.username }
expect(response.status).to eq(200)
expect(response.parsed_body["error"]).not_to be_present
end
3.times do
post "/session/forgot_password.json", params: { login: user.username }
expect(response.status).to eq(200)
expect(response.parsed_body["error"]).not_to be_present
end
expect(response.status).to eq(422)
post "/session/forgot_password.json", params: { login: user.username }
expect(response.status).to eq(422)
3.times do
post "/session/forgot_password.json",
params: {
login: user.username,
},
headers: {
"REMOTE_ADDR" => "10.1.1.1",
}
expect(response.status).to eq(200)
expect(response.parsed_body["error"]).not_to be_present
end
3.times do
post "/session/forgot_password.json",
params: {
login: user.username,
},
headers: {
"REMOTE_ADDR" => "10.1.1.1",
"REMOTE_ADDR" => "100.1.1.1",
}
expect(response.status).to eq(200)
expect(response.parsed_body["error"]).not_to be_present
# not allowed, max 6 a day
expect(response.status).to eq(422)
end
post "/session/forgot_password.json",
params: {
login: user.username,
},
headers: {
"REMOTE_ADDR" => "100.1.1.1",
}
# not allowed, max 6 a day
expect(response.status).to eq(422)
end
context "for a non existant username" do