From 7e60f4876a067b4e0aa4ae9fb579342914532ce6 Mon Sep 17 00:00:00 2001
From: Luc Didry <luc@didry.org>
Date: Tue, 29 Apr 2014 23:54:27 +0200
Subject: [PATCH] Fix #29

Configurable antiflood protection for the "Download by URL" feature
---
 Changes                 |  3 +++
 lib/Lutim.pm            | 20 ++++++++++++++------
 lib/Lutim/Controller.pm |  5 +++++
 lutim.conf.template     |  5 +++++
 4 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/Changes b/Changes
index ecbf298..92a222d 100644
--- a/Changes
+++ b/Changes
@@ -1,5 +1,8 @@
 Revision history for LUTIm
 
+0.3  2014-
+	- Antiflood protection for the "Download by URL" feature (#29)
+
 0.2  2014-03-07
 	- Server-side encryption available
 	- Thumbnails of uploaded images in response
diff --git a/lib/Lutim.pm b/lib/Lutim.pm
index 9b7ffe0..618dc8a 100644
--- a/lib/Lutim.pm
+++ b/lib/Lutim.pm
@@ -10,16 +10,19 @@ mkdir($ENV{MOJO_TMPDIR}, 0700) unless (-d $ENV{MOJO_TMPDIR});
 sub startup {
     my $self = shift;
 
+    $self->{wait_for_it} = {};
+
     $self->plugin('I18N');
 
     my $config = $self->plugin('Config');
 
     # Default values
-    $config->{provisioning}   = 100 unless (defined($config->{provisionning}));
-    $config->{provisioning}   = 100 unless (defined($config->{provisioning}));
-    $config->{provis_step}    = 5   unless (defined($config->{provis_step}));
-    $config->{length}         = 8   unless (defined($config->{length}));
-    $config->{always_encrypt} = 0   unless (defined($config->{always_encrypt}));
+    $config->{provisioning}     = 100 unless (defined($config->{provisionning}));
+    $config->{provisioning}     = 100 unless (defined($config->{provisioning}));
+    $config->{provis_step}      = 5   unless (defined($config->{provis_step}));
+    $config->{length}           = 8   unless (defined($config->{length}));
+    $config->{always_encrypt}   = 0   unless (defined($config->{always_encrypt}));
+    $config->{anti_flood_delay} = 5   unless (defined($config->{anti_flood_delay}));
 
     die "You need to provide a contact information in lutim.conf !" unless (defined($config->{contact}));
 
@@ -257,7 +260,12 @@ sub startup {
 
     $self->hook(
         after_dispatch => sub {
-            shift->provisioning();
+            my $c = shift;
+            $c->provisioning();
+
+            # Purge expired anti-flood protection
+            my $wait_for_it = $c->app->{wait_for_it};
+            delete @{$wait_for_it}{grep { time - $wait_for_it->{$_} > $c->config->{anti_flood_delay} } keys %{$wait_for_it}} if (defined($wait_for_it));
         }
     );
 
diff --git a/lib/Lutim/Controller.pm b/lib/Lutim/Controller.pm
index 9a0e44b..a880285 100644
--- a/lib/Lutim/Controller.pm
+++ b/lib/Lutim/Controller.pm
@@ -54,6 +54,10 @@ sub add {
     if(!defined($c->stash('stop_upload'))) {
         if (defined($file_url) && $file_url) {
             if (is_http_uri($file_url) || is_https_uri($file_url)) {
+                # Anti-flood protection
+                while (defined($c->app->{wait_for_it}->{$c->ip}) && (time - $c->app->{wait_for_it}->{$c->ip}) <= $c->config->{anti_flood_delay} ) {
+                    sleep($c->config->{anti_flood_delay});
+                }
                 my $ua = Mojo::UserAgent->new;
                 my $tx = $ua->get($file_url => {DNT => 1});
                 if (my $res = $tx->success) {
@@ -66,6 +70,7 @@ sub add {
                         asset    => $tx->res->content->asset,
                         filename => $filename
                     );
+                    $c->app->{wait_for_it}->{$c->ip} = time;
                 } else {
                     my $msg = $c->l('download_error');
                     if (defined($c->param('format')) && $c->param('format') eq 'json') {
diff --git a/lutim.conf.template b/lutim.conf.template
index dbe475a..38514f5 100644
--- a/lutim.conf.template
+++ b/lutim.conf.template
@@ -39,6 +39,11 @@
     # optional, default is 100
     #provisioning      => 100,
 
+    # anti-flood protection delay, in seconds
+    # users won't be able to ask LUTIm to download images more than one per anti_flood_delay seconds
+    # optional, default is 5
+    #anti_flood_delay  => 5
+
     # twitter account which will appear on twitter cards
     # see https://dev.twitter.com/docs/cards/validation/validator to register your LUTIm instance on twitter
     # optional, default is @framasky