diff options
Diffstat (limited to 'src/api/routes/auth/register.ts')
| -rw-r--r-- | src/api/routes/auth/register.ts | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/src/api/routes/auth/register.ts b/src/api/routes/auth/register.ts index 370d7c52..eba86f77 100644 --- a/src/api/routes/auth/register.ts +++ b/src/api/routes/auth/register.ts @@ -17,6 +17,7 @@ import { } from "@fosscord/api"; import bcrypt from "bcrypt"; import { HTTPError } from "lambert-server"; +import { MoreThan } from "typeorm"; const router: Router = Router(); @@ -25,7 +26,7 @@ router.post( route({ body: "RegisterSchema" }), async (req: Request, res: Response) => { const body = req.body as RegisterSchema; - const { register, security } = Config.get(); + const { register, security, limits } = Config.get(); const ip = getIpAdress(req); // email will be slightly modified version of the user supplied email -> e.g. protection against GMail Trick @@ -198,6 +199,19 @@ router.post( }); } + if ( + limits.absoluteRate.register.enabled && + (await User.count({ where: { created_at: MoreThan(new Date(Date.now() - limits.absoluteRate.register.window)) } })) + >= limits.absoluteRate.register.limit + ) { + console.log( + `Global register ratelimit exceeded for ${getIpAdress(req)}, ${req.body.username}, ${req.body.invite || "No invite given"}` + ); + throw FieldErrors({ + email: { code: "TOO_MANY_REGISTRATIONS", message: req.t("auth:register.TOO_MANY_REGISTRATIONS") } + }); + } + const user = await User.register({ ...body, req }); if (body.invite) { |