From ee1119208c613b9ded7ebfb2a5a7b8bd5a5ef008 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Mon, 1 Mar 2021 18:39:47 +0100 Subject: Add `POST /api/v1/emails/confirmations` to REST API (#15816) Only available to the application the user originally signed-up with --- config/initializers/rack_attack.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'config/initializers') diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index c0db49907..2a6cca7dc 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -94,11 +94,15 @@ class Rack::Attack end throttle('throttle_email_confirmations/ip', limit: 25, period: 5.minutes) do |req| - req.remote_ip if req.post? && req.path == '/auth/confirmation' + req.remote_ip if req.post? && %w(/auth/confirmation /api/v1/emails/confirmations).include?(req.path) end throttle('throttle_email_confirmations/email', limit: 5, period: 30.minutes) do |req| - req.params.dig('user', 'email').presence if req.post? && req.path == '/auth/password' + if req.post? && req.path == '/auth/password' + req.params.dig('user', 'email').presence + elsif req.post? && req.path == '/api/v1/emails/confirmations' + req.authenticated_user_id + end end throttle('throttle_login_attempts/ip', limit: 25, period: 5.minutes) do |req| -- cgit