add ratelimiting to routes and config.ini

luser/config.ini

@@ -4,3 +4,6 @@ LDAPADMINNAME = cn=admin,dc=example,dc=org
 LDAPPASS = verysecr3t
 USERBASE = ou=Users,dc=example,dc=org
 CAPTCHA_PATH = /var/luser/luser/static/register/captcha_img/
+[ratelimit]
+PERIOD = 1d
+LIMIT = 10

luser/routes.py

@@ -19,6 +19,9 @@ LDAPPASS = config.get('credentials', 'LDAPPASS')
 USERBASE = config.get('credentials', 'USERBASE')
 CAPTCHA_PATH = config.get('credentials', 'CAPTCHA_PATH')
 
+PERIOD = config.get('ratelimit', 'PERIOD')
+LIMIT = config.get('ratelimit', 'LIMIT')
+
 @app.route('/account/changepassword/', methods=['POST', 'GET'])
 def changepassword():
     if request.method == 'GET':
@@ -84,6 +87,9 @@ def unregister():
 
 @app.route('/account/register/', methods=['POST', 'GET'])
 def register():
+    rl = ratelimit(PERIOD, LIMIT, "/var/luser/luser/.ratelimit")
+    if rl.check(1):
+        return 'Error: rate limit exceeded, please come again in ' + PERIOD
     if request.method == 'GET':
         captcha_solution = str(random.randint(0,999999))
         captcha_hash = ldap_salted_sha1.hash(captcha_solution)
@@ -146,6 +152,7 @@ def register():
             #smtpctlout=subprocess.run(["smtpctl","encrypt", password],text=True,stdout=subprocess.PIPE)
             #smtpdhash=smtpctlout.stdout[:-1]
             if luser.add(username,ldaphash):
+                rl.add(1)
                 return 'User successfuly registered'
             else:
                 return 'User registration failed, username probably taken'