forked from rDrama/rDrama
Rate limiter: whitelist admins.
Due to presently hitting perpetual 429s after a mishap with lottery polling on production, among past events where admins have gotten rate-limited for doing otherwise normal admin behavior, the flask_limiter.Limiter now has a request filter to whitelist JL2+. Despite running on every request, I don't anticipate this undermining the DoS prevention power of the Limiter. It is yet unknown whether there are edge cases where running get_logged_in_user in a different spot in the request pipeline might e.g. subtly break the logged-in counters. This is not expected at present, however.master
parent
c73f97c183
commit
4ba2098612
|
@ -1,10 +1,17 @@
|
||||||
from .get import *
|
from .get import *
|
||||||
from .alerts import *
|
from .alerts import *
|
||||||
from files.helpers.const import *
|
from files.helpers.const import *
|
||||||
from files.__main__ import db_session
|
from files.__main__ import db_session, limiter
|
||||||
from random import randint
|
from random import randint
|
||||||
import user_agents
|
import user_agents
|
||||||
|
|
||||||
|
@limiter.request_filter
|
||||||
|
def limiter_whitelist_admins():
|
||||||
|
v = get_logged_in_user()
|
||||||
|
if not v:
|
||||||
|
return False
|
||||||
|
return v.admin_level >= 2
|
||||||
|
|
||||||
def get_logged_in_user():
|
def get_logged_in_user():
|
||||||
|
|
||||||
if hasattr(g, 'v'): return g.v
|
if hasattr(g, 'v'): return g.v
|
||||||
|
|
Loading…
Reference in New Issue