From 944d8bd8f3c5cf8ae296fc03d149056c65358426 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leonel=20C=C3=A2mara?= Date: Wed, 4 May 2016 19:02:53 +0100 Subject: [PATCH] Check if host is denied before verifying password --- applications/admin/controllers/default.py | 3 +++ applications/admin/models/access.py | 8 ++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/applications/admin/controllers/default.py b/applications/admin/controllers/default.py index 9eaf90d1..bed4e863 100644 --- a/applications/admin/controllers/default.py +++ b/applications/admin/controllers/default.py @@ -121,6 +121,9 @@ def index(): send = URL('site') if session.authorized: redirect(send) + elif failed_login_count() >= allowed_number_of_attempts: + time.sleep(2 ** allowed_number_of_attempts) + raise HTTP(403) elif request.vars.password: if verify_password(request.vars.password[:1024]): session.authorized = True diff --git a/applications/admin/models/access.py b/applications/admin/models/access.py index fa1ee01c..b94ce8d0 100644 --- a/applications/admin/models/access.py +++ b/applications/admin/models/access.py @@ -104,13 +104,12 @@ def write_hosts_deny(denied_hosts): portalocker.unlock(f) f.close() - def login_record(success=True): denied_hosts = read_hosts_deny() val = (0, 0) if success and request.client in denied_hosts: del denied_hosts[request.client] - elif not success and not request.is_local: + elif not success: val = denied_hosts.get(request.client, (0, 0)) if time.time() - val[1] < expiration_failed_logins \ and val[0] >= allowed_number_of_attempts: @@ -121,6 +120,11 @@ def login_record(success=True): write_hosts_deny(denied_hosts) return val[0] +def failed_login_count(): + denied_hosts = read_hosts_deny() + val = denied_hosts.get(request.client, (0, 0)) + return val[0] + # ########################################################### # ## session expiration