m724/anonsubmit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix admin ratelimit

Browse source
This commit is contained in:
Minecon724 2025-04-02 16:42:11 +02:00
commit 884a31dfdb
Signed by untrusted user who does not match committer: m724
GPG key ID: A02E6E67AB961189
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/anonchat/routes.py
View file

@ -10,11 +10,14 @@ import hashlib
import json import json
from datetime import datetime from datetime import datetime
def is_admin():
return 'admin_authenticated' in session and session['admin_authenticated']
# Admin authentication middleware # Admin authentication middleware
def admin_required(f): def admin_required(f):
@wraps(f) @wraps(f)
def decorated_function(*args, **kwargs): def decorated_function(*args, **kwargs):
if 'admin_authenticated' not in session or not session['admin_authenticated']: if not is_admin():
return redirect(url_for('admin_login', next=request.url)) return redirect(url_for('admin_login', next=request.url))
return f(*args, **kwargs) return f(*args, **kwargs)
return decorated_function return decorated_function
@ -136,10 +139,9 @@ def admin_login():
return render_template('admin_login.html') return render_template('admin_login.html')
@app.route('/admin', methods=['POST']) @app.route('/admin', methods=['POST'])
@limiter.limit("1 per minute") @limiter.limit("1 per minute", deduct_when=lambda response: not is_admin())
@limiter.limit("10 per hour") @limiter.limit("10 per hour")
def admin_login_post(): def admin_login_post():
error = None
username = request.form.get('username') username = request.form.get('username')
password = request.form.get('password') password = request.form.get('password')
@ -157,7 +159,7 @@ def admin_login_post():
return redirect(next_page) return redirect(next_page)
return redirect(url_for('admin_dashboard')) return redirect(url_for('admin_dashboard'))
else: else:
flash('Invalid username or password', 'error') flash('Invalid username or password. Try again in 1 minute.', 'error')
return redirect(url_for('admin_login')) return redirect(url_for('admin_login'))