Files
cgm-remote-monitor/lib/authorization/delaylist.js
T
Sulka HaroandGitHub 914ba78f36 Security improvement batch (#6622)
* Adds a new method for the server to push notifies to the client, which require administration privileges from the user. If there are messages in queue but user is not privileged, she is notified of pending messages

* Fix unit tests

* Increase timeouts on tests

* Add translations

* * Aggregate admin messages
* Send admin message on auth fail
* Sending messages over bus
* XSS filtering of objects sent over the REST API

* Warn users if their instance is world readable

* Fix adminnotifies init()

* Fix couple issues from Codacy
2021-01-07 22:46:55 +02:00

59 lines
1.3 KiB
JavaScript
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
'use strict';
const _ = require('lodash');
function init (env) {
const ipDelayList = {};
const DELAY_ON_FAIL = _.get(env, 'settings.authFailDelay') || 5000;
const FAIL_AGE = 60000;
ipDelayList.addFailedRequest = function addFailedRequest (ip) {
const ipString = String(ip);
let entry = ipDelayList[ipString];
const now = Date.now();
if (!entry) {
ipDelayList[ipString] = now + DELAY_ON_FAIL;
return;
}
if (now >= entry) { entry = now; }
ipDelayList[ipString] = entry + DELAY_ON_FAIL;
};
ipDelayList.shouldDelayRequest = function shouldDelayRequest (ip) {
const ipString = String(ip);
const entry = ipDelayList[ipString];
let now = Date.now();
if (entry) {
if (now < entry) {
return entry - now;
}
}
return false;
};
ipDelayList.requestSucceeded = function requestSucceeded (ip) {
const ipString = String(ip);
if (ipDelayList[ipString]) {
delete ipDelayList[ipString];
}
};
// Clear items older than a minute
setTimeout(function clearList () {
for (var key in ipDelayList) {
if (ipDelayList.hasOwnProperty(key)) {
if (Date.now() > ipDelayList[key] + FAIL_AGE) {
delete ipDelayList[key];
}
}
}
}, 30000);
return ipDelayList;
}
module.exports = init;