diff options
author | Mayra Cabrera <mcabrera@gitlab.com> | 2019-07-24 22:49:31 +0300 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2019-07-24 22:49:31 +0300 |
commit | 3cefc5d7df09dbc21cd9c892bc6c62b5b583ca6a (patch) | |
tree | 2e996ca71e4e16c74f1be94d1f7143ac3e49dad6 /app/controllers/projects/raw_controller.rb | |
parent | b70dbabb6373e7624e3bcb7a6d78049621db891c (diff) |
Add RateLimiter to RawController
* Limits raw requests to 300 per minute and per raw path.
* Add a new attribute to ApplicationSettings so user can change this
value on their instance.
* Uses Gitlab::ActionRateLimiter to limit the raw requests.
* Add a new method into ActionRateLimiter to log the event into auth.log
Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/48717
Diffstat (limited to 'app/controllers/projects/raw_controller.rb')
-rw-r--r-- | app/controllers/projects/raw_controller.rb | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/app/controllers/projects/raw_controller.rb b/app/controllers/projects/raw_controller.rb index 42ae5b0ef3c..3254229d9cb 100644 --- a/app/controllers/projects/raw_controller.rb +++ b/app/controllers/projects/raw_controller.rb @@ -8,10 +8,30 @@ class Projects::RawController < Projects::ApplicationController before_action :require_non_empty_project before_action :assign_ref_vars before_action :authorize_download_code! + before_action :show_rate_limit, only: [:show] def show @blob = @repository.blob_at(@commit.id, @path) send_blob(@repository, @blob, inline: (params[:inline] != 'false')) end + + private + + def show_rate_limit + limiter = ::Gitlab::ActionRateLimiter.new(action: :show_raw_controller) + + return unless limiter.throttled?([@project, @commit, @path], raw_blob_request_limit) + + limiter.log_request(request, :raw_blob_request_limit, current_user) + + flash[:alert] = _('You cannot access the raw file. Please wait a minute.') + redirect_to project_blob_path(@project, File.join(@ref, @path)) + end + + def raw_blob_request_limit + Gitlab::CurrentSettings + .current_application_settings + .raw_blob_request_limit + end end |