[ADD] Rate limiting to (failed) login attempts

Task 31122 section 4.

Implement per-IP rate limiting of login attempts after some number
of failures.

* check_credentials has no reason to be public, make it private
* add hooks to check for login cooldown on a source IP (remote_addr:
  http://werkzeug.pocoo.org/docs/0.14/wrappers/#werkzeug.wrappers.BaseRequest.remote_addr)
  basis
* add baseline/default configuration of 60s cooldown
* add baseline threshold of 10 login failures, after checking odoo.com
  logs it looks like we have short runs of up to 7 failures (assumed
  to be legitimate) before the user either gets it right or goes and
  looks it up

Depends on #24187

1 files changed, 6 insertions, 1 deletions

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index bf27842d55e..1269c175cd0 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -482,13 +482,18 @@ class Home(http.Controller):
             values['databases'] = None
 
         if request.httprequest.method == 'POST':
+            # ensure there's no leftover in the session from non-web auth
+            request.session.pop('login_error', None)
             old_uid = request.uid
             uid = request.session.authenticate(request.session.db, request.params['login'], request.params['password'])
             if uid is not False:
                 request.params['login_success'] = True
                 return http.redirect_with_hash(self._login_redirect(uid, redirect=redirect))
             request.uid = old_uid
-            values['error'] = _("Wrong login/password")
+            values['error'] = request.session.pop(
+                'login_error',
+                _("Wrong login/password")
+            )
         else:
             if 'error' in request.params and request.params.get('error') == 'access':
                 values['error'] = _('Only employee can access this database. Please contact the administrator.')