FIX: Incorrect topic per-minute invitation rate limit (#31252)

This fixes an issue where the topic invitation rate limiter
for invites for the 1 minute period was incorrectly using
1 day as the length of time the limit should be applied over.
The default for `max_topic_invitations_per_minute` is 5,
so this would be very easy to exceed, then the user gets
a very confusing warning message saying they have to wait
23 hours to send more invites.

This commit also makes other `RateLimiter` period parameters
more consistent by always using the form `N.PERIOD` instead
of things like `86_400` hardcoded seconds per day.
This commit is contained in:
Martin Brennan
2025-02-10 13:12:16 +10:00
committed by GitHub
parent 8d3a35e25b
commit ec7c6b1f96
7 changed files with 27 additions and 12 deletions

View File

@@ -123,7 +123,7 @@ class Auth::DefaultCurrentUserProvider
current_user = nil
if auth_token
limiter = RateLimiter.new(nil, "cookie_auth_#{request.ip}", COOKIE_ATTEMPTS_PER_MIN, 60)
limiter = RateLimiter.new(nil, "cookie_auth_#{request.ip}", COOKIE_ATTEMPTS_PER_MIN, 1.minute)
if limiter.can_perform?
@env[USER_TOKEN_KEY] = @user_token =
@@ -435,7 +435,7 @@ class Auth::DefaultCurrentUserProvider
limit = [GlobalSetting.max_admin_api_reqs_per_key_per_minute.to_i, limit].max
end
@admin_api_key_limiter =
RateLimiter.new(nil, "admin_api_min", limit, 60, error_code: "admin_api_key_rate_limit")
RateLimiter.new(nil, "admin_api_min", limit, 1.minute, error_code: "admin_api_key_rate_limit")
end
def user_api_key_limiter_60_secs
@@ -444,7 +444,7 @@ class Auth::DefaultCurrentUserProvider
nil,
"user_api_min_#{@hashed_user_api_key}",
GlobalSetting.max_user_api_reqs_per_minute,
60,
1.minute,
error_code: "user_api_key_limiter_60_secs",
)
end
@@ -455,7 +455,7 @@ class Auth::DefaultCurrentUserProvider
nil,
"user_api_day_#{@hashed_user_api_key}",
GlobalSetting.max_user_api_reqs_per_day,
86_400,
1.day,
error_code: "user_api_key_limiter_1_day",
)
end