From b707ae292c9b98dc63e763f1652f9621d72cbcb7 Mon Sep 17 00:00:00 2001
From: Spitap <dev@asdrip.fr>
Date: Wed, 1 Feb 2023 14:09:28 +0100
Subject: [PATCH] use of url for the throttle scope of ddos

---
 modoboa/admin/api/v2/tests.py           | 3 ---
 modoboa/lib/throttle.py                 | 6 ++----
 modoboa/limits/api/v1/viewsets.py       | 4 ++--
 modoboa/relaydomains/api/v1/viewsets.py | 7 +------
 4 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/modoboa/admin/api/v2/tests.py b/modoboa/admin/api/v2/tests.py
index 36a8afc97..b4235ad95 100644
--- a/modoboa/admin/api/v2/tests.py
+++ b/modoboa/admin/api/v2/tests.py
@@ -229,9 +229,6 @@ class AccountViewSetTestCase(ModoAPITestCase):
         url = reverse("v2:account-validate")
         resp = self.client.post(url, data, format="json")
         self.assertEqual(resp.status_code, 204)
-        for _ in range(500):
-            resp = self.client.post(url, data, format="json")
-        self.assertEqual(resp.status_code, 429)
 
     def test_random_password(self):
         url = reverse("v2:account-random-password")
diff --git a/modoboa/lib/throttle.py b/modoboa/lib/throttle.py
index e77d797db..1bea8c580 100644
--- a/modoboa/lib/throttle.py
+++ b/modoboa/lib/throttle.py
@@ -10,9 +10,8 @@ class UserDdosPerView(SimpleRateThrottle):
             ident = request.user.pk
         else:
             ident = self.get_ident(request)
-
         return self.cache_format % {
-            'scope': hash(f"{view.basename}_{view.name}"),
+            'scope': hash(request.path),
             'ident': ident
         }
 
@@ -26,8 +25,7 @@ class UserLesserDdosUser(SimpleRateThrottle):
             ident = request.user.pk
         else:
             ident = self.get_ident(request)
-
         return self.cache_format % {
-            'scope': self.scope,
+            'scope': hash(request.path),
             'ident': ident
         }
diff --git a/modoboa/limits/api/v1/viewsets.py b/modoboa/limits/api/v1/viewsets.py
index c335b4843..053352575 100644
--- a/modoboa/limits/api/v1/viewsets.py
+++ b/modoboa/limits/api/v1/viewsets.py
@@ -7,7 +7,7 @@ from rest_framework.permissions import DjangoModelPermissions, IsAuthenticated
 from rest_framework.throttling import UserRateThrottle
 
 from modoboa.core import models as core_models
-from modoboa.lib.throttle import UserDdosPerView
+from modoboa.lib.throttle import UserLesserDdosUser
 from . import serializers
 
 
@@ -19,7 +19,7 @@ class ResourcesViewSet(
 
     permission_classes = [IsAuthenticated, DjangoModelPermissions]
     serializer_class = serializers.ResourcesSerializer
-    throttle_classes = [UserDdosPerView, UserRateThrottle]
+    throttle_classes = [UserLesserDdosUser, UserRateThrottle]
 
     def get_queryset(self):
         """Filter queryset based on current user."""
diff --git a/modoboa/relaydomains/api/v1/viewsets.py b/modoboa/relaydomains/api/v1/viewsets.py
index a1804f926..0bf7a81ab 100644
--- a/modoboa/relaydomains/api/v1/viewsets.py
+++ b/modoboa/relaydomains/api/v1/viewsets.py
@@ -15,12 +15,7 @@ class RelayDomainViewSet(RevisionModelMixin, viewsets.ModelViewSet):
 
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     serializer_class = serializers.RelayDomainSerializer
-
-    def get_throttles(self):
-        if self.action:
-            self.throttle_classes.append(UserLesserDdosUser)
-        return super().get_throttles()
-
+    throttle_classes = [UserLesserDdosUser]
 
     def get_queryset(self):
         """Filter queryset based on current user."""