Make throttling more strict

modoboa/admin/api/v1/viewsets.py

@@ -11,11 +11,13 @@ from rest_framework.decorators import action
 from rest_framework.exceptions import ParseError
 from rest_framework.permissions import DjangoModelPermissions, IsAuthenticated
 from rest_framework.response import Response
+from rest_framework.throttling import UserRateThrottle
 
 from modoboa.core import models as core_models
 from modoboa.core import sms_backends
 from modoboa.lib import renderers as lib_renderers
 from modoboa.lib import viewsets as lib_viewsets
+from modoboa.lib.throttle import UserDdosPerView
 
 from ... import lib, models
 from . import serializers
@@ -40,6 +42,7 @@ class DomainViewSet(lib_viewsets.RevisionModelMixin, viewsets.ModelViewSet):
 
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     serializer_class = serializers.DomainSerializer
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_queryset(self):
         """Filter queryset based on current user."""
@@ -69,6 +72,7 @@ class DomainAliasViewSet(lib_viewsets.RevisionModelMixin,
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     renderer_classes = (renderers.JSONRenderer, lib_renderers.CSVRenderer)
     serializer_class = serializers.DomainAliasSerializer
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_queryset(self):
         """Filter queryset based on current user."""
@@ -86,6 +90,7 @@ class AccountViewSet(lib_viewsets.RevisionModelMixin, viewsets.ModelViewSet):
     filter_backends = (filters.SearchFilter, )
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     search_fields = ("^first_name", "^last_name", "^email")
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_serializer_class(self):
         """Return a serializer."""
@@ -183,6 +188,7 @@ class AliasViewSet(lib_viewsets.RevisionModelMixin, viewsets.ModelViewSet):
 
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     serializer_class = serializers.AliasSerializer
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_queryset(self):
         """Filter queryset based on current user."""
@@ -215,6 +221,7 @@ class SenderAddressViewSet(lib_viewsets.RevisionModelMixin,
     filterset_class = SenderAddressFilterSet
     permission_classes = [IsAuthenticated, DjangoModelPermissions, ]
     serializer_class = serializers.SenderAddressSerializer
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_queryset(self):
         """Filter queryset based on current user."""

modoboa/admin/api/v2/viewsets.py

@@ -11,12 +11,13 @@ from rest_framework import (
 )
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
+from rest_framework.throttling import UserRateThrottle
 
 from modoboa.admin.api.v1 import viewsets as v1_viewsets
 from modoboa.core import models as core_models
 from modoboa.lib import renderers as lib_renderers
 from modoboa.lib import viewsets as lib_viewsets
-from modoboa.lib.throttle import UserDosThrottleViewset
+from modoboa.lib.throttle import UserDdosPerView
 
 from ... import lib
 from ... import models
@@ -52,7 +53,7 @@ class DomainViewSet(lib_viewsets.RevisionModelMixin,
     permission_classes = (
         permissions.IsAuthenticated, permissions.DjangoModelPermissions,
     )
-    throttle_classes = [UserDosThrottleViewset]
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_queryset(self):
         """Filter queryset based on current user."""
@@ -161,7 +162,6 @@ class AccountViewSet(v1_viewsets.AccountViewSet):
 
     filter_backends = (filters.SearchFilter, dj_filters.DjangoFilterBackend)
     filterset_class = AccountFilterSet
-    throttle_classes = [UserDosThrottleViewset]
 
     def get_serializer_class(self):
         if self.action in ["create", "validate", "update", "partial_update"]:
@@ -216,7 +216,7 @@ class IdentityViewSet(viewsets.ViewSet):
 
     permission_classes = (permissions.IsAuthenticated, )
     serializer_class = None
-    throttle_classes = [UserDosThrottleViewset]
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def list(self, request, **kwargs):
         """Return all identities."""
@@ -256,7 +256,7 @@ class AliasViewSet(v1_viewsets.AliasViewSet):
     """Viewset for Alias."""
 
     serializer_class = serializers.AliasSerializer
-    throttle_classes = [UserDosThrottleViewset]
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     @action(methods=["post"], detail=False)
     def validate(self, request, **kwargs):
@@ -278,7 +278,7 @@ class AliasViewSet(v1_viewsets.AliasViewSet):
 class UserAccountViewSet(viewsets.ViewSet):
     """Viewset for current user operations."""
 
-    throttle_classes = [UserDosThrottleViewset]
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     @action(methods=["get", "post"], detail=False)
     def forward(self, request, **kwargs):
@@ -341,7 +341,7 @@ class AlarmViewSet(viewsets.ReadOnlyModelViewSet):
     )
     search_fields = ["domain__name", "title"]
     serializer_class = serializers.AlarmSerializer
-    throttle_classes = [UserDosThrottleViewset]
+    throttle_classes = [UserDdosPerView, UserRateThrottle]
 
     def get_queryset(self):
         return models.Alarm.objects.select_related("domain").filter(