Commit ec1572fb authored by Luc Didry's avatar Luc Didry

Hardening ban system

This commit is dedicated to guilhemB, who is supporting me on Tipeee.
Many thanks :-)
parent 004d8e85
Pipeline #8869 failed with stage
in 11 minutes and 59 seconds
......@@ -55,24 +55,24 @@ sub add {
} else {
my @records = LstuModel::Lstu->select('WHERE url = ?', $url);
my @bans = LstuModel::Ban->select('WHERE ip = ?', $ip);
if (scalar @bans) {
$bans[0]->update(
strike => $bans[0]->strike + 1,
until => time + 1
);
} else {
LstuModel::Ban->create(
ip => $ip,
strike => 1,
until => time + 1
);
}
if (scalar(@records) && !defined($custom_url)) {
# Already got this URL
$short = $records[0]->short;
} else {
my @bans = LstuModel::Ban->select('WHERE ip = ?', $ip);
if (scalar @bans) {
$bans[0]->update(
strike => $bans[0]->strike + 1,
until => time + 1
);
} else {
LstuModel::Ban->create(
ip => $ip,
strike => 1,
until => time + 1
);
}
if(LstuModel->begin) {
if (defined($custom_url)) {
LstuModel::Lstu->create(
......
......@@ -77,14 +77,13 @@ $t->get_ok('/d/'.$a.'?format=json')
$t->post_ok('/stats' => form => { adminpwd => 'toto', action => 'logout' })
->status_is(200);
LstuModel::Ban->delete_where('1 = 1');
# Test admin banishing
$t->post_ok('/stats' => form => { adminpwd => 'totoi' })
->status_is(200)
->content_like(qr/Bad password/);
$t->post_ok('/stats' => form => { adminpwd => 'totoi' })
->status_is(200)
->content_like(qr/Bad password/);
for my $i (1..3) {
$t->post_ok('/stats' => form => { adminpwd => 'totoi' })
->status_is(200)
->content_like(qr/Bad password/);
}
$t->post_ok('/stats' => form => { adminpwd => 'totoi' })
->status_is(200)
......@@ -93,16 +92,11 @@ $t->post_ok('/stats' => form => { adminpwd => 'totoi' })
# Test user banishing
LstuModel::Ban->delete_where('1 = 1'); # Reset banishing
LstuModel::Lstu->delete_where('1 = 1');
$t->ua->post('/a' => form => { lsturl => 'https://lstu.fr', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://lut.im', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://erco.xyz', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://onsenfout.fr', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://framasoft.org', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://framagit.org', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://framateam.org', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://frama.io', format => 'json' });
$t->post_ok('/a' => form => { lsturl => 'https://lufi.io', format => 'json' })
$t->ua->post('/a' => form => { lsturl => 'https://lstu.fr', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://lstu.fr', format => 'json' });
$t->ua->post('/a' => form => { lsturl => 'https://lstu.fr', format => 'json' });
$t->post_ok('/a' => form => { lsturl => 'https://lstu.fr', format => 'json' })
->status_is(200)
->json_has('msg', 'success')
->json_is('/success' => false)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment