Page MenuHomePhorge
Files F85832437

No OneTemporary
Actions

Authored By
Unknown
Size
3 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
index 82abfce7f..57e3a2d5b 100644
--- a/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
@@ -12,6 +12,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
alias Pleroma.Web.CommonAPI
alias Pleroma.Web.MastodonAPI.StatusView
alias Pleroma.Web.Plugs.OAuthScopesPlug
+ alias Pleroma.Web.Plugs.RateLimiter
plug(Pleroma.Web.ApiSpec.CastAndValidate)
plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action in [:create, :delete])
@@ -22,6 +23,14 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
when action == :index
)
+ plug(
+ RateLimiter,
+ [name: :status_id_action, bucket_name: "status_id_action:emoji_react", params: [:id]]
+ when action in [:create, :delete]
+ )
+
+ plug(RateLimiter, [name: :statuses_actions] when action in [:create, :delete])
+
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.EmojiReactionOperation
action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
diff --git a/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs b/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs
index 8fcdb233b..12b037a21 100644
--- a/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs
+++ b/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs
@@ -477,4 +477,53 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionControllerTest do
|> get("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
end
+
+ describe "rate limiting" do
+ test "PUT and DELETE share a per-status limit", %{conn: conn} do
+ clear_config([:rate_limit, :status_id_action], {60_000, 2})
+ user = insert(:user)
+ %{id: activity_id} = insert(:note_activity)
+ %{id: other_activity_id} = insert(:note_activity)
+ conn = prepare_conn_of_user(conn, user)
+
+ conn
+ |> put("/api/v1/pleroma/statuses/#{activity_id}/reactions/☕")
+ |> json_response_and_validate_schema(200)
+
+ conn
+ |> delete("/api/v1/pleroma/statuses/#{activity_id}/reactions/☕")
+ |> json_response_and_validate_schema(200)
+
+ assert conn
+ |> put("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
+ |> json_response(429) == %{"error" => "Throttled"}
+
+ conn
+ |> put("/api/v1/pleroma/statuses/#{other_activity_id}/reactions/🐈")
+ |> json_response_and_validate_schema(200)
+ end
+
+ test "PUT and DELETE count against statuses_actions", %{conn: conn} do
+ clear_config([:rate_limit, :statuses_actions], {60_000, 2})
+ user = insert(:user)
+ [first, second, third] = insert_list(3, :note_activity)
+ conn = prepare_conn_of_user(conn, user)
+
+ conn
+ |> put("/api/v1/pleroma/statuses/#{first.id}/reactions/☕")
+ |> json_response_and_validate_schema(200)
+
+ conn
+ |> delete("/api/v1/pleroma/statuses/#{first.id}/reactions/☕")
+ |> json_response_and_validate_schema(200)
+
+ assert conn
+ |> put("/api/v1/pleroma/statuses/#{second.id}/reactions/☕")
+ |> json_response(429) == %{"error" => "Throttled"}
+
+ assert conn
+ |> delete("/api/v1/pleroma/statuses/#{third.id}/reactions/☕")
+ |> json_response(429) == %{"error" => "Throttled"}
+ end
+ end
end

File Metadata

Mime Type
text/x-diff
Expires
Mon, Nov 2, 8:22 AM (15 h, 18 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1803803
Default Alt Text
(3 KB)

Event Timeline