QOLDEV-638 throttle data request creation #93
Conversation
ThrawnCA
commented
Oct 17, 2023
ThrawnCA
commented
- Restrict unprivileged accounts to creating one data request every five minutes. Increase the delay if they continue to attempt it.
- Restrict unprivileged accounts to one request every 5 minutes. Increase the delay if they keep trying. Privileged accounts (edit permissions in any organisation) are unrestricted.
ThrawnCA
requested review from
duttonw,
kundupz,
chris-randall-qol and
RossWebsterWork
There was a problem hiding this comment.
should we not increase the time between submission on the same session instead of doubling it if they try to soon.
i.e.
first one (instance)
2nd one (5min wait)
3rd one (10min wait)
4th on(15min wait)
I'd also like you to add ip address tracking for this to stop multi user creation to bypass this.
the way you have it delays submitting for users who don't know or can't read.
So a linear increase, then? If you think that's better, then sure, it's easy to do. It might also be good to put a maximum in, I suppose, eg one day. More than that likely isn't helpful, it's just asking for overflow-based exploits.
That might be a good avenue for future enhancement, independently of data requests in particular. |
|
we can leave it with Double the delay every time someone tries too soonunsure how safe it would be for time delays for multiple creates. might need something that lasts for a full session (maybe 24hours to keep count on submissions.) |
- Increase the delay linearly instead of doubling - Cap the maximum delay to avoid overflow problems
