Commit Graph

317 Commits (d01d6e183ad87ef63274ac5e1ca9cb6ea0a84e58)

Author SHA1 Message Date
Snakes 8fee66c894
Reorder decorators to support f63237a9a2.
Ultimately necessary because otherwise all bots share rate limits
with each other. The somewhat haphazard ordering of decorators bothers
me, but it's functionally required.

Approaches using request context (like reading the Authorization
header in ratelimit_user) likely produce bugs all their own.
2022-11-13 05:18:52 -05:00
justcool393 aa272729f1 default ratelimit and default ratelimit slower 2022-11-13 00:43:47 -06:00
justcool393 80d7d5281d ratelimit_user() wrapper 2022-11-13 00:07:15 -06:00
Aevann1 0796a17422 switch from hcaptcha to turnstile 2022-11-11 20:34:06 +02:00
justcool393 26549a6e66
remove logged out routes (#433)
* remove /logged_out/ routes

* update sitemap, remove users route, and update header

* cloudflare cookie

* only mess with the cookie whenever we desire auth

* sitemap: (small) improvements
sitemap: fix little bug i introduced
sitemap: fix login redirects for /id/ routes

* sitemap: remove duplicate entry

* contact is auth desired

* imports: don't import what we don't need and bind late to the db

* praying to god this works

* keep yourself safe

* oh i actually need to commit and push lol

* import Sub

* t

* refix cache purger
2022-11-09 00:35:24 -05:00
justcool393 7d80483f67 alts: only change session data if new include_current_session flag is set 2022-11-01 16:58:42 -05:00
Aevann1 58912b124a display "@" before account name in failed login attempt 2022-10-28 22:25:35 +02:00
Aevann1 449c8b51cb Revert "add another ratelimit by username"
This reverts commit 4385bafa85.
2022-10-28 20:25:14 +02:00
Aevann1 4385bafa85 add another ratelimit by username 2022-10-28 20:22:51 +02:00
Aevann1 e1dc790165 tighten from 15/day to 10/day 2022-10-28 20:13:37 +02:00
Aevann1 e41ee21f2b remove redundant ratelimits in /login 2022-10-28 20:13:23 +02:00
Snakes 1f27b0fb2f
Rate limit failed logins. 2022-10-28 14:07:24 -04:00
Aevann1 ad358650e1 remove retarded bullshit I wasn't consulted about 2022-10-27 19:53:08 +02:00
justcool393 50482c9b0e T to t 2022-10-26 18:41:29 -05:00
justcool393 e6f735b8ca security: be slightly more generous with login ratelimits 2022-10-26 14:18:21 -05:00
justcool393 782a4494da login: create invalid file if doesn't exist 2022-10-26 14:11:30 -05:00
justcool393 03cf8038f3 security: log invalid password attempts for admins
security: reduce login ratelimits from 1/second ->1/10 seconds
security: reduce login ratelimits from 200/hr -> 100/hr
security: reduce login ratelimits from 1000/day -> 500/day
2022-10-26 13:31:17 -05:00
gooseman 8b98eabbb9 simultaneous hosts 2022-10-24 15:28:43 -07:00
justcool393 f4af073253 fix 17 potential 500s 2022-10-16 02:51:42 -07:00
justcool393 6138c94a10 unduplicated alt adding code
* should probably be part of the Alt or User class at some point but this is for a diff day
2022-10-15 11:52:10 -07:00
justcool393 39aa59a37a add g.is_api_or_xhr so we can use it where we want to give API output
* also use v.client for strict API clients
2022-10-15 02:11:36 -07:00
Aevann1 89a0ff4a4b remove username reservation system 2022-10-14 14:01:06 +02:00
Aevann1 30813fc719 Merge branch 'frost' of https://github.com/Aevann1/rDrama into frost 2022-10-10 11:06:32 +02:00
Aevann1 00b045c464 tweak env again 2022-10-10 11:06:27 +02:00
justcool393 f872f734ec constantify a bunch of things
* sign up follow id is now a thing (if not specified will just msg carp instead)
* notification thread id is also a constant now
* blackjackbtz id is a constant, used for i think special PM handling
2022-10-09 23:37:42 -07:00
Aevann1 aa8e7055fb rework env vars a bit 2022-10-08 02:43:04 +02:00
Aevann1 f5f0f7d528 give carp notifs for new users on rdrama again + make new users follow kippy on PCM 2022-10-06 00:22:57 +02:00
Aevann1 bf9a2398da add nginx to docker 2022-10-04 21:48:52 +02:00
Aevann1 3bf62c6ff0 add missing ban_reason when shadowbanning 2022-10-02 13:31:02 +02:00
justcool393 7e3f43c9ab
unperson shadowbanned users (#373)
* unperson shadowbanned users
if a shadowbanned user copes, does anyone hear them seethe?

* unperson shadowbanned users (by id)

* don't import that

* Add include_blocks.
We don't always want to request blocks from the db when we have a user set

* block shadowbanned users from hole mod tools

* don't allow awarding shadowbanned things

* fix conflict

* gracefully use get_account when specified and also add include_blocks flag to get_account as well
2022-09-30 14:00:58 -07:00
Aevann1 c67b4eea0a limit new users following carp to WPD 2022-09-29 16:16:35 +02:00
Aevann1 37e1f25624 make using proxies only happen in 3 circumstances again 2022-09-26 06:01:25 +02:00
Aevann1 f2af76c905 add proxies on hcaptcha requests 2022-09-26 04:40:58 +02:00
Aevann1 0c182585c1 save ragnar on WPD 2022-09-24 03:41:35 +02:00
Aevann1 ce4d2ada9e fix the @tax situation 2022-09-23 14:36:10 +02:00
Aevann1 d1bc2f3468 integrate check_ban_evade into check_for_alts 2022-09-23 14:33:58 +02:00
Aevann1 8a8a67a059 remove ban_evade logic 2022-09-22 21:40:14 +02:00
Aevann1 0c3cf0128a "That" -> "This" 2022-09-13 11:59:29 +02:00
Aevann1 cefd68755d stop the print spam 2022-09-11 03:56:47 +02:00
Aevann1 0c32d56cd6 casino + style shit 2022-09-05 01:15:37 +02:00
Aevann1 9a32337a22 add flush=true to a print statement 2022-09-02 19:43:59 +02:00
Aevann1 11afc5cff1 fix redirection on signup 2022-08-30 21:03:49 +02:00
Aevann1 26959e0751 murder deuxrama.net 2022-08-11 18:46:11 +02:00
Aevann1 e286a2e881 spam carp inbox 2022-08-04 22:44:59 +02:00
Aevann1 07be18cd1b fix 500 errors 2022-07-28 16:23:38 +02:00
Aevann1 5a2dc01990 modify new user message a little 2022-07-16 01:31:40 +02:00
Snakes dfa700ab1a Deux: patch improper logins for post-seeding accs.
Deux's users were originally seeded from a clone of the rDrama DB.
Thereby, user IDs are paired between the sites, and this is further
the only clear means by which we can link accounts between the sites.
However, signups on either site after the seeding will not have
synchronized IDs. Newer accounts on Drama could thereby be used to
sign into the Deux account with the same user_id.

There's no clear way to solve this without going to a shared identity
provider for both. In the interim, we restrict shared login to users
from before divergence began. This is a kludge, but it works.
2022-07-14 03:00:08 -04:00
Snakes 88108594ad Implement Deux login with rDrama challenge. 2022-07-13 20:36:04 -04:00
Aevann1 f5bacd8938 Revert "log ppl into deux automatically"
This reverts commit 86f7e627ea.
2022-07-13 20:33:31 +02:00
Aevann1 2d21863e19 replace "request.host" with "SITE" 2022-07-13 20:14:37 +02:00
Aevann1 86f7e627ea log ppl into deux automatically 2022-07-13 20:14:07 +02:00
Aevann1 9c3976a622 make new users follow carp automatically v2 2022-07-10 18:23:32 +02:00
Aevann1 d3b15e2b8a make new users follow carp automatically on rdrama 2022-07-10 18:13:16 +02:00
Aevann1 3cd0878d0a fix redirect bug 2022-07-10 14:09:03 +02:00
Snakes fde2d5ca11 LGB: Use static default pfp. 2022-07-09 07:11:05 -04:00
Snakes 0fbb102929 Propagate shadows to new alts on signup. 2022-07-09 05:25:15 -04:00
Aevann1 a8fe49f232 kitchen sink commit, all over the place 2022-07-08 21:03:04 +02:00
Aevann1 b617321529 move all env-getting to .const 2022-07-08 18:21:13 +02:00
Aevann1 05b70969e5 trying to fix WPD's issue 2022-07-06 12:56:39 +02:00
Aevann1 bce4c13043 kitchen sink commit, all over the place 2022-07-02 12:44:05 +02:00
Aevann1 d0d15c319a Poll rework (#312)
* poll rework

* forgot to do joinedload on comments

* Fix logic errors with voting, SQL syntax.

Kitchen sink commit from review of poll-rework changes:
  1. Fix seed-db.sql syntax error.
  2. Fix SQL patch file duplication of *submissions* tables rather
     than one set of submissions and one for comments.
  3. Start makeshift SQL patch folder, since this is a large change
     that contributors may wish to apply to their local instances.
  4. Fix checkbox (non-`exclusive`) polls being unable to be
     unchecked. For consistency with `exclusive` polls, they should.
  5. Fix changing the option of an `exclusive` poll when both
     exclusive and non-exclusive options are present in one comment/
     post causing the non-exclusive options to become unchecked.
     (which, by my reading of SQLAlchemy `Query.one_or_none()`
     really could break quite badly in some cases).

* link relationships with their counterparts

* small modification to poll unchecking

Co-authored-by: TLSM <duolsm@outlook.com>
2022-07-02 08:48:04 +02:00
Aevann1 8ba9aab351 fix WPD's bug 2022-06-28 06:51:34 +02:00
Aevann1 785cea9c4c fix 500 eror on signup 2022-06-27 02:49:30 +02:00
Aevann1 49e39b94bc fix signups 2022-06-26 07:03:30 +02:00
Aevann1 cff34fb3a4 reducing query volume, #2 2022-06-26 03:11:02 +02:00
Aevann1 f34c4e1196 stop using app.config for our own stuff 2022-06-24 17:08:57 +02:00
Aevann1 9593dc58dd move regex from helpers.const into its own helper file 2022-06-24 16:30:59 +02:00
Aevann1 6f6d01c1c6 actually use the get functions 2022-06-24 15:19:53 +02:00
Aevann1 f60db1598d replace "g.db.query" on pkeys with the much more efficient "g.db.get" 2022-06-18 02:57:23 +02:00
Snakes 7e54f858d3 Amend f8ae2a3d17c6: revert >= logic, fail loudly.
First, the apparent errors with >= 9 and 99 in the Marseys and
referrals code after the refactor are not actually bugs: they were
bug fixes mixed in with the refactor to fix an off-by-one.

Next, instead of failing silently on the `not user` branch in
badge_grant, we throw a ValueError. This retains the current
behavior where users get 500s to report while also enforcing the
assertion near the edge of the function.
2022-06-15 16:32:25 -04:00
Snakes f8ae2a3d17 Amend 3bc98f0a6b84: minor logic, style. 2022-06-15 16:08:26 -04:00
Aevann1 3bc98f0a6b extend TLSM's badge_grant() to almost all instanes where badges are granted 2022-06-15 21:33:21 +02:00
Aevann1 c8e0d8b1c3 catch email exception 2022-06-13 18:28:37 +02:00
Aevann1 758a30e166 fsd 2022-05-26 22:53:24 +02:00
Aevann1 d4f7f5497b fds 2022-05-26 22:49:36 +02:00
Aevann1 1e8c00f6fe fsd 2022-05-26 21:15:24 +02:00
Aevann1 32bc1b3c2a afsfds 2022-05-26 01:46:38 +02:00
Aevann1 b254fd77cb fsd 2022-05-26 01:25:51 +02:00
Aevann1 1c6ca7c9e0 fds 2022-05-26 00:02:54 +02:00
Aevann1 60058c5130 fsd 2022-05-26 00:02:18 +02:00
Aevann1 50b995d3a0 fds 2022-05-25 22:16:26 +02:00
Aevann1 386db76c10 crgd is a king 2022-05-25 20:29:22 +02:00
Aevann1 162bf9dad7 no more g.timestamp y'all couldn't behave 2022-05-25 17:42:04 +02:00
Aevann1 2cfd7c74a0 fds 2022-05-20 21:00:13 +02:00
Aevann1 ed0d225554 sfd 2022-05-14 15:11:11 +02:00
Aevann1 b71ae6cc74 sf 2022-05-09 13:21:49 +02:00
Aevann1 6b10d097a2 mn 2022-05-05 01:09:46 +02:00
Aevann1 47d01ed00b vb 2022-05-03 04:15:35 +02:00
Aevann1 cb847ecd4f hg 2022-04-20 19:13:27 +02:00
Aevann1 9c0441aef9 fsd 2022-04-17 23:46:29 +02:00
Aevann1 348d698239 fds 2022-04-14 18:26:41 +02:00
Aevann1 579e81de2a site settings 2022-04-12 21:05:50 +02:00
Aevann1 15a02cf3cd fds 2022-04-10 01:07:03 +02:00
Aevann1 b5fbc876a5 gfd 2022-04-02 20:35:16 +02:00
Aevann1 7713fd891d fsd 2022-04-02 19:11:35 +02:00
Aevann1 56f5d44c90 vxc 2022-04-02 18:47:11 +02:00
Aevann1 b1341f9e47 sfd 2022-03-27 15:41:19 +02:00
Aevann1 5327fe5992 fd 2022-03-26 00:38:05 +02:00
Aevann1 0c5435e04f sfd 2022-03-18 20:31:24 +02:00
Aevann1 514d6ec126 right 2022-03-09 03:44:53 +02:00