mirror of
https://github.com/overleaf/overleaf.git
synced 2024-09-16 02:52:31 -04:00
64f69529e0
Add additional rate limits to prevent resource-exhaustion attacks GitOrigin-RevId: 428cf8a16e062267dd92e7fba73ef5c192a8e668
33 lines
2 KiB
CoffeeScript
33 lines
2 KiB
CoffeeScript
EditorHttpController = require('./EditorHttpController')
|
|
AuthenticationController = require "../Authentication/AuthenticationController"
|
|
AuthorizationMiddlewear = require('../Authorization/AuthorizationMiddlewear')
|
|
RateLimiterMiddlewear = require('../Security/RateLimiterMiddlewear')
|
|
|
|
module.exports =
|
|
apply: (webRouter, apiRouter) ->
|
|
webRouter.post '/project/:Project_id/doc', AuthorizationMiddlewear.ensureUserCanWriteProjectContent,
|
|
RateLimiterMiddlewear.rateLimit({
|
|
endpointName: "add-doc-to-project"
|
|
params: ["Project_id"]
|
|
maxRequests: 30
|
|
timeInterval: 60
|
|
}), EditorHttpController.addDoc
|
|
webRouter.post '/project/:Project_id/folder', AuthorizationMiddlewear.ensureUserCanWriteProjectContent,
|
|
RateLimiterMiddlewear.rateLimit({
|
|
endpointName: "add-folder-to-project"
|
|
params: ["Project_id"]
|
|
maxRequests: 60
|
|
timeInterval: 60
|
|
}), EditorHttpController.addFolder
|
|
|
|
webRouter.post '/project/:Project_id/:entity_type/:entity_id/rename', AuthorizationMiddlewear.ensureUserCanWriteProjectContent, EditorHttpController.renameEntity
|
|
webRouter.post '/project/:Project_id/:entity_type/:entity_id/move', AuthorizationMiddlewear.ensureUserCanWriteProjectContent, EditorHttpController.moveEntity
|
|
|
|
webRouter.delete '/project/:Project_id/file/:entity_id', AuthorizationMiddlewear.ensureUserCanWriteProjectContent, EditorHttpController.deleteFile
|
|
webRouter.delete '/project/:Project_id/doc/:entity_id', AuthorizationMiddlewear.ensureUserCanWriteProjectContent, EditorHttpController.deleteDoc
|
|
webRouter.delete '/project/:Project_id/folder/:entity_id', AuthorizationMiddlewear.ensureUserCanWriteProjectContent, EditorHttpController.deleteFolder
|
|
|
|
# Called by the real-time API to load up the current project state.
|
|
# This is a post request because it's more than just a getting of data. We take actions
|
|
# whenever a user joins a project, like updating the deleted status.
|
|
apiRouter.post '/project/:Project_id/join', AuthenticationController.httpAuth, EditorHttpController.joinProject
|