diff options
| author | Xavier Morel <xmo@odoo.com> | 2018-01-12 15:50:12 +0100 |
|---|---|---|
| committer | Xavier Morel <xmo@odoo.com> | 2018-07-26 15:53:26 +0200 |
| commit | a8d868e2877e12e2c5c6329055f6c8568d286331 (patch) | |
| tree | 410fb43e22b8a32d1626f3657f1c45bc7077cd8a /addons/auth_ldap/models | |
| parent | 48c058112f840992947551cfe3c74f6f448bf1fe (diff) | |
[ADD] Rate limiting to (failed) login attempts
Task 31122 section 4.
Implement per-IP rate limiting of login attempts after some number
of failures.
* check_credentials has no reason to be public, make it private
* add hooks to check for login cooldown on a source IP (remote_addr:
http://werkzeug.pocoo.org/docs/0.14/wrappers/#werkzeug.wrappers.BaseRequest.remote_addr)
basis
* add baseline/default configuration of 60s cooldown
* add baseline threshold of 10 login failures, after checking odoo.com
logs it looks like we have short runs of up to 7 failures (assumed
to be legitimate) before the user either gets it right or goes and
looks it up
Depends on #24187
Diffstat (limited to 'addons/auth_ldap/models')
| -rw-r--r-- | addons/auth_ldap/models/res_users.py | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/addons/auth_ldap/models/res_users.py b/addons/auth_ldap/models/res_users.py index 83887f802a0..9e783064557 100644 --- a/addons/auth_ldap/models/res_users.py +++ b/addons/auth_ldap/models/res_users.py @@ -29,10 +29,9 @@ class Users(models.Model): break return user_id - @api.model - def check_credentials(self, password): + def _check_credentials(self, password): try: - super(Users, self).check_credentials(password) + super(Users, self)._check_credentials(password) except AccessDenied: if self.env.user.active: Ldap = self.env['res.company.ldap'] |