Changeset 5363

Timestamp:

04/18/2017 10:59:33 PM (9 years ago)

Author:

iandunn

Message:

WordCamp Post Type: Rate-limit application submissions to avoid cleanup work

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/applications/wordcamp.php (modified) (3 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/applications/wordcamp.php

@@ -49 +49 @@
                 $application_data = validate_data( $_POST );
 
-                if ( is_wp_error( $application_data ) ) {
+                if ( is_rate_limited() ) {
+                        $message        = 'You have submitted too many applications recently. Please wait and try again in a few hours.';
+                        $notice_classes = 'notice-error';
+                } else if ( is_wp_error( $application_data ) ) {
                         $message = $application_data->get_error_message();
                         $notice_classes = 'notice-error';
@@ -67 +70 @@
 
         return ob_get_clean();
+}
+
+/**
+ * Check if the application submitter has been rate limited
+ *
+ * This isn't really designed to protect against DDoS or anything sophisticated; it just prevents us from having
+ * to clean up thousands of fake applications when security researchers use bots to probe for vulnerabilities.
+ *
+ * @return bool
+ */
+function is_rate_limited() {
+        $limit = 3;
+
+        $previous_entries = get_posts( array(
+                'post_type'      => WCPT_POST_TYPE_ID,
+                'post_status'    => 'any',
+                'posts_per_page' => $limit,
+                'orderby'        => 'date',
+                'order'          => 'DESC',
+                'fields'         => 'ids',
+
+                'date_query' => array(
+                        array(
+                                'column'    => 'post_date',
+                                'after'     => '1 hour ago',
+                                'inclusive' => true,
+                        ),
+                ),
+
+                'meta_query' => array(
+                        array(
+                                'key'   => '_application_submitter_ip_address',
+                                'value' => $_SERVER['REMOTE_ADDR'],
+                        ),
+                ),
+        ) );
+
+        return count( $previous_entries ) >= $limit;
 }
 
@@ -193 +234 @@
         // Populate the meta fields
         add_post_meta( $post_id, '_application_data', $data );
+        add_post_meta( $post_id, '_application_submitter_ip_address', $_SERVER['REMOTE_ADDR'] );
 
         add_post_meta( $post_id, 'Organizer Name', sprintf(