Mercurial > p > roundup > code
view test/test_admin.py @ 5717:cad18de2b988
issue2550949: Rate limit password guesses/login attempts.
Generic rate limit mechanism added. Deployed for web page
logins. Default is 3 login attempts/minute for a user. After which one
login attempt every 20 seconds can be done.
Uses gcra algorithm so all I need to store is a username and timestamp
in the one time key database. This does mean I don't have a list of
all failed login attempts as part of the rate limiter.
Set up config setting as well so admin can tune the rate. Maybe 1
every 10 seconds is ok at a site with poor typists who need 6 attempts
to get the password right 8-).
The gcra method can also be used to limit the rest and xmlrpc
interfaces if needed. The mechanism I added also supplies a status
method that calculates the expected values for http headers returned
as part of rate limiting.
Also tests added to test all code paths I hope.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sat, 11 May 2019 17:24:58 -0400 |
| parents | 95dfdbaf5aa6 |
| children | b76be13e027e |
line wrap: on
line source
# # Copyright (C) 2007 Stefan Seefeld # All rights reserved. # For license terms see the file COPYING.txt. # from __future__ import print_function import unittest, os, shutil, errno, sys, difflib, cgi, re from roundup.admin import AdminTool from . import db_test_base from .test_mysql import skip_mysql from .test_postgresql import skip_postgresql class AdminTest(object): backend = None def setUp(self): self.dirname = '_test_admin' def tearDown(self): try: shutil.rmtree(self.dirname) except OSError as error: if error.errno not in (errno.ENOENT, errno.ESRCH): raise def testInit(self): import sys self.admin=AdminTool() sys.argv=['main', '-i', '_test_admin', 'install', 'classic', self.backend] ret = self.admin.main() print(ret) self.assertTrue(ret == 0) self.assertTrue(os.path.isfile(self.dirname + "/config.ini")) self.assertTrue(os.path.isfile(self.dirname + "/schema.py")) class anydbmAdminTest(AdminTest, unittest.TestCase): backend = 'anydbm' @skip_mysql class mysqlAdminTest(AdminTest, unittest.TestCase): backend = 'mysql' class sqliteAdminTest(AdminTest, unittest.TestCase): backend = 'sqlite' @skip_postgresql class postgresqlAdminTest(AdminTest, unittest.TestCase): backend = 'postgresql'
