yourabi / django-banish Goto Github PK

Hi,

I'm on heroku and have issue with getting client's IP value. I fixed this here #17. Now it works fine on heroku. Please, merge this or let me know in case of questions,

Thanks,
Anton Shutik

Lines 36, 37 of middleware.py read BANSIH instead of BANISH

Occasionally on all sorts of pages I will get this traceback:

Traceback (most recent call last):

  File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 90, in get_response
    response = middleware_method(request)

  File "/usr/local/lib/python2.7/dist-packages/banish/middleware.py", line 80, in process_request
    if self.is_banned(ip) or self.monitor_abuse(ip) or user_agent in self.BANNED_AGENTS:

  File "/usr/local/lib/python2.7/dist-packages/banish/middleware.py", line 113, in monitor_abuse
    cache.incr(cache_key)

  File "/usr/local/lib/python2.7/dist-packages/django/core/cache/backends/locmem.py", line 81, in incr
    raise ValueError("Key '%s' not found" % key)

ValueError: Key 'DJANGO_BANISH_ABUSE:[ip address here]' not found

Solutions?

Steps to reproduce:

1. Set the default cache timeout to 60s using CACHES argument.
2. Throw a bunch of abusive traffic at django. (e.g., ab -c 2 -n 1000 http://127.0.0.1:8000/)

Expected results:
After the traffic trips the ABUSE_THRESHOLD, django-banish should respond with 403 for the client

Actual results:
After the traffic trips the ABUSE_THRESHOLD, django-banish responds with 403 for the client until the CACHES TIMEOUT value is reached. Then django-banish forgets that the IP is banished. It allows the requests thru until the same client trips the ABUSE_THRESHOLD again. And repeats this pattern.

Hey guys, is there a way to unban an ip address?

There is an optional setting BANISH_ABUSE_THRESHOLD for the number of requests per minute. However can I set a per hour threshold and not per minute?

On my django server someone is using a python script to send requests every 5 seconds. This amounts to 12 requests per minute. However setting a threshold to something like ~10 doesn't seem like a very good idea to me.

Another possible solution is can I use this library on requests on specific urls?

When I delete banned IP from admin panel I need to restart my memcached server for ativate my changes. Is this normal behavour?
Thanks for your work!

Traceback (most recent call last):
File "/app/.heroku/python/lib/python2.7/site-packages/django/core/handlers/base.py", line 87, in get_response
response = middleware_method(request)
File "/app/.heroku/python/lib/python2.7/site-packages/newrelic-2.22.1.20/newrelic/hooks/framework_django.py", line 221, in wrapper
return wrapped(_args, *_kwargs)
File "/app/.heroku/python/lib/python2.7/site-packages/banish/middleware.py", line 81, in process_request
return HttpResponseForbidden(self.BANISH_MESSAGE, mimetype="text/html")
File "/app/.heroku/python/lib/python2.7/site-packages/django/http/response.py", line 318, in init
super(HttpResponse, self).init(_args, *_kwargs)
TypeError: init() got an unexpected keyword argument 'mimetype'

When no user agent is set it causes unhandled exception:

    self.client.get('/')
  File "/usr/home/mysite/lib/python2.7/site-packages/django/test/client.py", line 453, in get
    response = super(Client, self).get(path, data=data, **extra)
  File "/usr/home/mysite/lib/python2.7/site-packages/django/test/client.py", line 279, in get
    return self.request(**r)
  File "/usr/home/mysite/lib/python2.7/site-packages/django/test/client.py", line 424, in request
    six.reraise(*exc_info)
  File "/usr/home/mysite/lib/python2.7/site-packages/django/core/handlers/base.py", line 92, in get_response
    response = middleware_method(request)
  File "/usr/home/mysite/lib/python2.7/site-packages/banish/middleware.py", line 66, in process_request
    user_agent = request.META['HTTP_USER_AGENT']
KeyError: 'HTTP_USER_AGENT'

The DJANGO_BANISH: cache prefix is repeated in models.py and in middleware.py.

Should move all cache prefixes into a single spot.

Please I need the latest version of django-banish, can you please make that update.