From 1de2e3f980549ce48eeeef99b99ac64987fcce44 Mon Sep 17 00:00:00 2001 From: Jeong Arm Date: Fri, 18 Feb 2022 21:51:51 +0900 Subject: Throttle IPv6 signup for subnet (#17588) --- config/initializers/rack_attack.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'config/initializers') diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 964d4266d..80c005f81 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -82,7 +82,9 @@ class Rack::Attack end throttle('throttle_sign_up_attempts/ip', limit: 25, period: 5.minutes) do |req| - req.remote_ip if req.post? && req.path == '/auth' + return unless req.post? && req.path == '/auth' + return req.remote_ip.mask(64) if req.remote_ip.ipv6? + req.remote_ip end throttle('throttle_password_resets/ip', limit: 25, period: 5.minutes) do |req| -- cgit From f9e7f2e4091cdeebfbdea47a49f020504dba038c Mon Sep 17 00:00:00 2001 From: zunda Date: Fri, 18 Feb 2022 19:21:21 +0000 Subject: Avoid return within block (#17590) This prevents the error: LocalJumpError (unexpected return) --- config/initializers/rack_attack.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'config/initializers') diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 80c005f81..a1fea7712 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -82,9 +82,13 @@ class Rack::Attack end throttle('throttle_sign_up_attempts/ip', limit: 25, period: 5.minutes) do |req| - return unless req.post? && req.path == '/auth' - return req.remote_ip.mask(64) if req.remote_ip.ipv6? - req.remote_ip + if req.post? && req.path == '/auth' + if req.remote_ip.ipv6? + req.remote_ip.mask(64) + else + req.remote_ip + end + end end throttle('throttle_password_resets/ip', limit: 25, period: 5.minutes) do |req| -- cgit