ip bans: rename ban types to full and partial.

Rename ban types from "normal" and "signup" to "full" and "partial".
This commit is contained in:
evazion
2020-04-07 14:59:46 -05:00
parent bfdb0a4f5e
commit 16011771f1
6 changed files with 17 additions and 17 deletions

View File

@@ -163,7 +163,7 @@ class ApplicationController < ActionController::Base
end end
def ip_ban_check def ip_ban_check
raise User::PrivilegeError if !request.get? && IpBan.hit!(:normal, CurrentUser.ip_addr) raise User::PrivilegeError if !request.get? && IpBan.hit!(:full, CurrentUser.ip_addr)
end end
def pundit_user def pundit_user

View File

@@ -59,7 +59,7 @@ class UsersController < ApplicationController
end end
def create def create
requires_verification = IpLookup.new(CurrentUser.ip_addr).is_proxy? || IpBan.hit!(:signup, CurrentUser.ip_addr) requires_verification = IpLookup.new(CurrentUser.ip_addr).is_proxy? || IpBan.hit!(:partial, CurrentUser.ip_addr)
@user = authorize User.new( @user = authorize User.new(
last_ip_addr: CurrentUser.ip_addr, last_ip_addr: CurrentUser.ip_addr,

View File

@@ -8,8 +8,8 @@ class IpBan < ApplicationRecord
deletable deletable
enum category: { enum category: {
normal: 0, full: 0,
signup: 100 partial: 100
}, _suffix: "ban" }, _suffix: "ban"
def self.ip_matches(ip_addr) def self.ip_matches(ip_addr)
@@ -50,13 +50,13 @@ class IpBan < ApplicationRecord
errors[:ip_addr] << "is invalid" errors[:ip_addr] << "is invalid"
elsif ip_addr.private? || ip_addr.loopback? || ip_addr.link_local? elsif ip_addr.private? || ip_addr.loopback? || ip_addr.link_local?
errors[:ip_addr] << "must be a public address" errors[:ip_addr] << "must be a public address"
elsif normal_ban? && ip_addr.ipv4? && ip_addr.prefix < 24 elsif full_ban? && ip_addr.ipv4? && ip_addr.prefix < 24
errors[:ip_addr] << "may not have a subnet bigger than /24" errors[:ip_addr] << "may not have a subnet bigger than /24"
elsif signup_ban? && ip_addr.ipv4? && ip_addr.prefix < 8 elsif partial_ban? && ip_addr.ipv4? && ip_addr.prefix < 8
errors[:ip_addr] << "may not have a subnet bigger than /8" errors[:ip_addr] << "may not have a subnet bigger than /8"
elsif normal_ban? && ip_addr.ipv6? && ip_addr.prefix < 64 elsif full_ban? && ip_addr.ipv6? && ip_addr.prefix < 64
errors[:ip_addr] << "may not have a subnet bigger than /64" errors[:ip_addr] << "may not have a subnet bigger than /64"
elsif signup_ban? && ip_addr.ipv6? && ip_addr.prefix < 20 elsif partial_ban? && ip_addr.ipv6? && ip_addr.prefix < 20
errors[:ip_addr] << "may not have a subnet bigger than /20" errors[:ip_addr] << "may not have a subnet bigger than /20"
elsif new_record? && IpBan.active.ip_matches(subnetted_ip).exists? elsif new_record? && IpBan.active.ip_matches(subnetted_ip).exists?
errors[:ip_addr] << "is already banned" errors[:ip_addr] << "is already banned"

View File

@@ -3,12 +3,12 @@
<h1>New IP Ban</h1> <h1>New IP Ban</h1>
<p> <p>
A normal IP ban restricts the IP from creating new accounts, logging in to A full IP ban prevents the IP from creating new accounts, logging in to
existing accounts, or editing the site in any way. existing accounts, or editing the site in any way.
</p> </p>
<p> <p>
A signup IP ban restricts new signups from editing anything until after A partial IP ban prevents new signups from editing anything until after
they've verified their email address. they've verified their email address.
<p> <p>
@@ -17,7 +17,7 @@
<%= edit_form_for(@ip_ban) do |f| %> <%= edit_form_for(@ip_ban) do |f| %>
<%= f.input :ip_addr, label: "IP Address", as: :string, hint: "Add /24 to ban a subnet. Example: 1.2.3.4/24" %> <%= f.input :ip_addr, label: "IP Address", as: :string, hint: "Add /24 to ban a subnet. Example: 1.2.3.4/24" %>
<%= f.input :reason, as: :string %> <%= f.input :reason, as: :string %>
<%= f.input :category, as: :select, include_blank: false, collection: [["Normal", "normal"], ["Signup", "signup"]] %> <%= f.input :category, as: :select, include_blank: false, collection: [["Full", "full"], ["Partial", "partial"]] %>
<%= f.button :submit, "Submit" %> <%= f.button :submit, "Submit" %>
<% end %> <% end %>
</div> </div>

View File

@@ -35,7 +35,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
end end
should "not allow IP banned users to login" do should "not allow IP banned users to login" do
@ip_ban = create(:ip_ban, category: :normal, ip_addr: "1.2.3.4") @ip_ban = create(:ip_ban, category: :full, ip_addr: "1.2.3.4")
post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" } post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" }
assert_response 403 assert_response 403
@@ -44,8 +44,8 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
assert(@ip_ban.last_hit_at > 1.minute.ago) assert(@ip_ban.last_hit_at > 1.minute.ago)
end end
should "allow signup-restricted IP banned users to login" do should "allow partial IP banned users to login" do
@ip_ban = create(:ip_ban, category: :signup, ip_addr: "1.2.3.4") @ip_ban = create(:ip_ban, category: :partial, ip_addr: "1.2.3.4")
post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" } post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" }
assert_redirected_to posts_path assert_redirected_to posts_path
@@ -55,7 +55,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
end end
should "ignore deleted IP bans when logging in" do should "ignore deleted IP bans when logging in" do
@ip_ban = create(:ip_ban, is_deleted: true, category: :normal, ip_addr: "1.2.3.4") @ip_ban = create(:ip_ban, is_deleted: true, category: :full, ip_addr: "1.2.3.4")
post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" } post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" }
assert_redirected_to posts_path assert_redirected_to posts_path

View File

@@ -168,11 +168,11 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
assert_equal(true, User.last.requires_verification) assert_equal(true, User.last.requires_verification)
end end
should "mark users signing up from a signup banned IP as requiring verification" do should "mark users signing up from a partial banned IP as requiring verification" do
skip unless IpLookup.enabled? skip unless IpLookup.enabled?
self.remote_addr = "187.37.226.17" self.remote_addr = "187.37.226.17"
@ip_ban = create(:ip_ban, ip_addr: self.remote_addr, category: :signup) @ip_ban = create(:ip_ban, ip_addr: self.remote_addr, category: :partial)
post users_path, params: { user: { name: "xxx", password: "xxxxx1", password_confirmation: "xxxxx1" }} post users_path, params: { user: { name: "xxx", password: "xxxxx1", password_confirmation: "xxxxx1" }}
assert_redirected_to User.last assert_redirected_to User.last