Merge pull request #20794 from edx/private_to_public_55dd3e1

Mergeback PR from private to public.

common/djangoapps/student/views/management.py

@@ -85,7 +85,7 @@ from student.models import (
 from student.signals import REFUND_ORDER
 from student.tasks import send_activation_email
 from student.text_me_the_app import TextMeTheAppFragmentView
-from util.bad_request_rate_limiter import BadRequestRateLimiter
+from util.request_rate_limiter import BadRequestRateLimiter, PasswordResetEmailRateLimiter
 from util.db import outer_atomic
 from util.json_request import JsonResponse
 from util.password_policy_validators import normalize_password, validate_password
@@ -664,10 +664,14 @@ def password_change_request_handler(request):
 
     """
 
-    limiter = BadRequestRateLimiter()
-    if limiter.is_rate_limit_exceeded(request):
+    password_reset_email_limiter = PasswordResetEmailRateLimiter()
+
+    if password_reset_email_limiter.is_rate_limit_exceeded(request):
         AUDIT_LOG.warning("Password reset rate limit exceeded")
-        return HttpResponseForbidden()
+        return HttpResponse(
+            _("Your previous request is in progress, please try again in a few moments."),
+            status=403
+        )
 
     user = request.user
     # Prefer logged-in user's email
@@ -681,9 +685,6 @@ def password_change_request_handler(request):
             destroy_oauth_tokens(user)
         except UserNotFound:
             AUDIT_LOG.info("Invalid password reset attempt")
-            # Increment the rate limit counter
-            limiter.tick_bad_request_counter(request)
-
             # If enabled, send an email saying that a password reset was attempted, but that there is
             # no user associated with the email
             if configuration_helpers.get_value('ENABLE_PASSWORD_RESET_FAILURE_EMAIL',
@@ -703,13 +704,13 @@ def password_change_request_handler(request):
                     language=settings.LANGUAGE_CODE,
                     user_context=message_context,
                 )
-
                 ace.send(msg)
         except UserAPIInternalError as err:
             log.exception('Error occured during password change for user {email}: {error}'
                           .format(email=email, error=err))
             return HttpResponse(_("Some error occured during password change. Please try again"), status=500)
 
+        password_reset_email_limiter.tick_request_counter(request)
         return HttpResponse(status=200)
     else:
         return HttpResponseBadRequest(_("No email address provided."))
@@ -770,7 +771,7 @@ def password_reset(request):
     else:
         # bad user? tick the rate limiter counter
         AUDIT_LOG.info("Bad password_reset user passed in.")
-        limiter.tick_bad_request_counter(request)
+        limiter.tick_request_counter(request)
 
     return JsonResponse({
         'success': True,

common/djangoapps/util/bad_request_rate_limiter.py

@@ -1,26 +0,0 @@
-"""
-A utility class which wraps the RateLimitMixin 3rd party class to do bad request counting
-which can be used for rate limiting
-"""
-from __future__ import absolute_import
-
-from ratelimitbackend.backends import RateLimitMixin
-
-
-class BadRequestRateLimiter(RateLimitMixin):
-    """
-    Use the 3rd party RateLimitMixin to help do rate limiting on the Password Reset flows
-    """
-
-    def is_rate_limit_exceeded(self, request):
-        """
-        Returns if the client has been rated limited
-        """
-        counts = self.get_counters(request)
-        return sum(counts.values()) >= self.requests
-
-    def tick_bad_request_counter(self, request):
-        """
-        Ticks any counters used to compute when rate limt has been reached
-        """
-        self.cache_incr(self.get_cache_key(request))

common/djangoapps/util/request_rate_limiter.py

@@ -0,0 +1,59 @@
+"""
+A utility class which wraps the RateLimitMixin 3rd party class to do bad request counting
+which can be used for rate limiting
+"""
+from __future__ import absolute_import
+
+from django.conf import settings
+from ratelimitbackend.backends import RateLimitMixin
+
+
+class RequestRateLimiter(RateLimitMixin):
+    """
+    Use the 3rd party RateLimitMixin to help do rate limiting.
+    """
+    def is_rate_limit_exceeded(self, request):
+        """
+        Returns if the client has been rated limited
+        """
+        counts = self.get_counters(request)
+        return sum(counts.values()) >= self.requests
+
+    def tick_request_counter(self, request):
+        """
+        Ticks any counters used to compute when rate limt has been reached
+        """
+        self.cache_incr(self.get_cache_key(request))
+
+
+class BadRequestRateLimiter(RequestRateLimiter):
+    """
+    Default rate limit is 30 requests for every 5 minutes.
+    """
+    pass
+
+
+class PasswordResetEmailRateLimiter(RequestRateLimiter):
+    """
+    Rate limiting requests to send password reset emails.
+    """
+    email_rate_limit = getattr(settings, 'PASSWORD_RESET_EMAIL_RATE_LIMIT', {})
+    requests = email_rate_limit.get('no_of_emails', 1)
+    cache_timeout_seconds = email_rate_limit.get('per_seconds', 60)
+    reset_email_cache_prefix = 'resetemail'
+
+    def key(self, request, dt):
+        """
+        Returns cache key.
+        """
+        return '%s-%s-%s' % (
+            self.reset_email_cache_prefix,
+            self.get_ip(request),
+            dt.strftime('%Y%m%d%H%M'),
+        )
+
+    def expire_after(self):
+        """
+        Returns timeout for cache keys.
+        """
+        return self.cache_timeout_seconds