Merge branch 'ratelimit' into main

src/api/admin.rs

@@ -166,6 +166,10 @@ fn post_admin_login(
 ) -> Result<Redirect, Flash<Redirect>> {
     let data = data.into_inner();
 
+    if crate::ratelimit::check_limit_admin(&ip.ip).is_err() {
+        return Err(Flash::error(Redirect::to(admin_url(referer)), "Too many requests, try again later."));
+    }
+
     // If the token is invalid, redirect to login page
     if !_validate_token(&data.token) {
         error!("Invalid admin token. IP: {}", ip.ip);

src/api/identity.rs

@@ -84,6 +84,9 @@ fn _password_login(data: ConnectData, conn: DbConn, ip: &ClientIp) -> JsonResult
         err!("Scope not supported")
     }
 
+    // Ratelimit the login
+    crate::ratelimit::check_limit_login(&ip.ip)?;
+
     // Get the user
     let username = data.username.as_ref().unwrap();
     let user = match User::find_by_mail(username, &conn) {