fix

modoboa/admin/api/v2/viewsets.py

@@ -17,7 +17,7 @@ from modoboa.admin.api.v1 import viewsets as v1_viewsets
 from modoboa.core import models as core_models
 from modoboa.lib import renderers as lib_renderers
 from modoboa.lib import viewsets as lib_viewsets
-from modoboa.lib.throttle import UserDdosPerView
+from modoboa.lib.throttle import UserDdosPerView, UserLesserDdosUser
 
 from ... import lib
 from ... import models
@@ -53,7 +53,14 @@ class DomainViewSet(lib_viewsets.RevisionModelMixin,
     permission_classes = (
         permissions.IsAuthenticated, permissions.DjangoModelPermissions,
     )
-    throttle_classes = [UserDdosPerView, UserRateThrottle]
+    throttle_classes = [UserDdosPerView]
+
+    def get_throttles(self):
+        if self.action in ['administrators']:
+            self.throttle_classes.append(UserLesserDdosUser)
+        else:
+            self.throttle_classes.append(UserDdosPerView)
+        return super().get_throttles()
 
     def get_queryset(self):
         """Filter queryset based on current user."""
@@ -163,6 +170,14 @@ class AccountViewSet(v1_viewsets.AccountViewSet):
     filter_backends = (filters.SearchFilter, dj_filters.DjangoFilterBackend)
     filterset_class = AccountFilterSet
 
+    def get_throttles(self):
+        if self.action in ['validate']:
+            self.throttle_classes.append(UserLesserDdosUser)
+        else:
+            self.throttle_classes.append(UserDdosPerView)
+        return super().get_throttles()
+
+
     def get_serializer_class(self):
         if self.action in ["create", "validate", "update", "partial_update"]:
             return serializers.WritableAccountSerializer
@@ -216,7 +231,15 @@ class IdentityViewSet(viewsets.ViewSet):
 
     permission_classes = (permissions.IsAuthenticated, )
     serializer_class = None
-    throttle_classes = [UserDdosPerView, UserRateThrottle]
+    throttle_classes = [UserDdosPerView]
+
+    def get_throttles(self):
+        if self.action in ['list']:
+            self.throttle_classes.append(UserLesserDdosUser)
+        else:
+            self.throttle_classes.append(UserDdosPerView)
+        return super().get_throttles()
+
 
     def list(self, request, **kwargs):
         """Return all identities."""
@@ -256,7 +279,7 @@ class AliasViewSet(v1_viewsets.AliasViewSet):
     """Viewset for Alias."""
 
     serializer_class = serializers.AliasSerializer
-    throttle_classes = [UserDdosPerView, UserRateThrottle]
+    throttle_classes = [UserDdosPerView, UserLesserDdosUser]
 
     @action(methods=["post"], detail=False)
     def validate(self, request, **kwargs):