Mercurial > p > roundup > code
view test/mocknull.py @ 5717:cad18de2b988
issue2550949: Rate limit password guesses/login attempts.
Generic rate limit mechanism added. Deployed for web page
logins. Default is 3 login attempts/minute for a user. After which one
login attempt every 20 seconds can be done.
Uses gcra algorithm so all I need to store is a username and timestamp
in the one time key database. This does mean I don't have a list of
all failed login attempts as part of the rate limiter.
Set up config setting as well so admin can tune the rate. Maybe 1
every 10 seconds is ok at a site with poor typists who need 6 attempts
to get the password right 8-).
The gcra method can also be used to limit the rest and xmlrpc
interfaces if needed. The mechanism I added also supplies a status
method that calculates the expected values for http headers returned
as part of rate limiting.
Also tests added to test all code paths I hope.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sat, 11 May 2019 17:24:58 -0400 |
| parents | b1ab8bd18e79 |
| children |
line wrap: on
line source
class MockNull: def __init__(self, **kwargs): for key, value in kwargs.items(): self.__dict__[key] = value def __call__(self, *args, **kwargs): return MockNull() def __getattr__(self, name): # This allows assignments which assume all intermediate steps are Null # objects if they don't exist yet. # # For example (with just 'client' defined): # # client.db.config.TRACKER_WEB = 'BASE/' self.__dict__[name] = MockNull() return getattr(self, name) def __getitem__(self, key): return self def __bool__(self): return False # Python 2 compatibility: __nonzero__ = __bool__ def __contains__(self, key): return False def __eq__(self, rhs): return False def __ne__(self, rhs): return False def __str__(self): return '' def __repr__(self): return '<MockNull 0x%x>'%id(self) def gettext(self, str): return str _ = gettext def get(self, name, default=None): try: return self.__dict__[name.lower()] except KeyError: return default
