mastodon

Commit Graph

Author	SHA1	Message	Date
Claire	eaedd52def	Fix incorrect rate limit on PUT requests (#31356 )	5 months ago
Claire	73a78cc19d	Fix rate-limiting incorrectly triggering a session cookie on most endpoints (#30483 )	7 months ago
Claire	3fa0dd0b88	Merge pull request from GHSA-c2r5-cfqr-c553 * Add hardening monkey-patch to prevent IP spoofing on misconfigured installations * Remove rack-attack safelist	7 months ago
Claire	16249946ae	Merge pull request from GHSA-q3rg-xx5v-4mxh	7 months ago
Emelia Smith	d20a5c3ec9	Fix: remove broken OAuth Application vacuuming & throttle OAuth Application registrations (#30316 ) Co-authored-by: Claire <claire.github-309c@sitedethib.com>	7 months ago
Matt Jankowski	933189887b	Fix `Style/StringLiterals` cop (#30005 )	9 months ago
Nick Schonning	85db392464	Autofix Rubocop cops for config/ (#24145 )	1 year ago
Matt Jankowski	2e1391fdd2	Fix `Naming/MemoizedInstanceVariableName` cop (#25928 )	1 year ago
Nick Schonning	c66250abf1	Autofix Rubocop Regex Style rules (#23690 ) Co-authored-by: Claire <claire.github-309c@sitedethib.com>	2 years ago
Nick Schonning	cee4369cf5	Autofix Rubocop Lint/AmbiguousOperatorPrecedence (#25002 )	2 years ago
Nick Schonning	49fad26eca	Drop EOL Ruby 2.7 (#24237 )	2 years ago
Eugen Rochko	c6ef56fd5e	Change rate limits to 1,500/5m per user, 300/5m per app (#23347 )	2 years ago
Eugen Rochko	21fd25a269	Fix rate limiting for paths with formats (#20675 )	2 years ago
dependabot[bot]	46ad7fea9d	Bump rack-attack from 6.5.0 to 6.6.0 (#17405 ) * Bump rack-attack from 6.5.0 to 6.6.0 Bumps [rack-attack](https://github.com/rack/rack-attack) from 6.5.0 to 6.6.0. - [Release notes](https://github.com/rack/rack-attack/releases) - [Changelog](https://github.com/rack/rack-attack/blob/master/CHANGELOG.md) - [Commits](https://github.com/rack/rack-attack/compare/v6.5.0...v6.6.0) --- updated-dependencies: - dependency-name: rack-attack dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Fix usage of deprecated API Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>	3 years ago
Claire	8603a07504	Fix error when trying to register (#17600 )	3 years ago
zunda	f9e7f2e409	Avoid return within block (#17590 ) This prevents the error: LocalJumpError (unexpected return)	3 years ago
Jeong Arm	1de2e3f980	Throttle IPv6 signup for subnet (#17588 )	3 years ago
Jeong Arm	ea61d3acd6	Fix media API limit (#17272 )	3 years ago
Eugen Rochko	ee1119208c	Add `POST /api/v1/emails/confirmations` to REST API (#15816 ) Only available to the application the user originally signed-up with	4 years ago
luigi	eb51e43fb4	Optimize some regex matching (#15528 ) * Use Regex#match? * Replace =~ too * Avoid to call match? from Nil * Keep value of Regexp.last_match	4 years ago
Eugen Rochko	5e1364c448	Add IP-based rules (#14963 )	4 years ago
Eugen Rochko	81a3db1564	Change rate limits for various paths (#14253 ) - Rate limit login attempts by target account - Rate limit password resets and e-mail re-confirmations by target account - Rate limit sign-up/login attempts, password resets, and e-mail re-confirmations by IP like before	5 years ago
Eugen Rochko	9241cbf861	Fix re-sending of e-mail confirmation not being rate limited (#13360 ) Fix #13330	5 years ago
Eugen Rochko	339ce1c4e9	Add specific rate limits for posting and following (#13172 )	5 years ago
Eugen Rochko	09d54d1f62	Fix uncaught query param encoding errors (#12741 )	5 years ago
Yamagishi Kazutoshi	4e1b742cb2	Change rate limit for media proxy (#11814 )	5 years ago
Hinaloe	b793722d7d	Fix undefined method error (#10868 )	6 years ago
mayaeh	afb17b7045	Fix undefined method error. (#10867 )	6 years ago
ThibG	0e9b8be18a	Improve rate limiting (#10860 ) * Rate limit based on remote address IP, not on potential reverse proxy * Limit rate of unauthenticated API requests further * Rate-limit paging requests to one every 3 seconds	6 years ago
Eugen Rochko	0e8819f0e8	Add rate limit for media proxy requests (#10490 ) 30 per 30 minutes, like media uploads	6 years ago
Eugen Rochko	99fa1ce93d	Add tight rate-limit for API deletions (#10042 ) Deletions take a lot of resources to execute and cause a lot of federation traffic, so it makes sense to decrease the number someone can queue up through the API. 30 per 30 minutes	6 years ago
Eugen Rochko	5d2fc6de32	Add REST API for creating an account (#9572 ) * Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account	6 years ago
aus-social	0a4739c732	lint pass 2 (#8878 ) * Code quality pass * Typofix * Update applications_controller_spec.rb * Update applications_controller_spec.rb	6 years ago
Akihiko Odaki	a7e71bbd08	Add a missing question mark in rack_attack.rb (#7338 )	7 years ago
Akihiko Odaki	b1d4471e36	Throttle media post (#7337 ) The previous rate limit allowed to post media so fast that it is possible to fill up the disk space even before an administrator notices. The new rate limit is configured so that it takes 24 hours to eat 10 gigabytes: 10 * 1024 / 8 / (24 * 60 / 30) = 27 (which rounded to 30) The period is set long so that it does not prevent from attaching several media to one post, which would happen in a short period. For example, if the period is 5 minutes, the rate limit would be: 10 * 1024 / 8 / (24 * 60 / 5) = 4 This long period allows to lift the limit up.	7 years ago
Eugen Rochko	921b781909	Increase rate limit on protected paths (#6229 ) Previously each protected path had a separate rate limit. Now they're all in the same bucket, so people are more likely to hit one with register->login. Increasing to 25 per 5 minutes should be fine.	7 years ago
Eugen Rochko	feed07227b	Apply a 25x rate limit by IP even to authenticated requests (#5948 )	7 years ago
Naoki Kosaka	4bce376fdc	Missing require 'authorization_decorator'. (#5947 )	7 years ago
Eugen Rochko	a865b62efc	Rate limit by user instead of IP when API user is authenticated (#5923 ) * Fix #668 - Rate limit by user instead of IP when API user is authenticated * Fix code style issue * Use request decorator provided by Doorkeeper	7 years ago
unarist	b42c018bb8	Add Content-Type header on throttled response to fix mojibake (#4558 ) application/json only allows Unicode, so this prevents from wrong charset detection.	8 years ago
alpaca-tc	db92eec876	Localize 'throttled' (#2755 )	8 years ago
Tristan Mahé	964035b118	allow localhost to bypass the ratelimit (#2554 )	8 years ago
Eugen	ff5baa5349	Add rate limits for logins and sign-ups by IP (5 in 5 minutes) (#2079 ) * Add rate limits for logins and sign-ups by IP (5 in 5 minutes) Should be enough for normal attempts * Add rate limit for forgotten password form as well	8 years ago

43 Commits (36ccdcc9e12d35399742cbe05c2589d69dbbbc99)