updated plugin ActivityPub version 9.1.0
This commit is contained in:
@ -118,21 +118,13 @@ class Clients_Controller extends \WP_REST_Controller {
|
||||
// Rate-limit registrations to prevent DB spam (max 10 per minute per IP).
|
||||
$ip = get_client_ip();
|
||||
if ( '' === $ip ) {
|
||||
return new \WP_Error(
|
||||
'activitypub_rate_limited',
|
||||
\__( 'Too many client registration requests. Please try again later.', 'activitypub' ),
|
||||
array( 'status' => 429 )
|
||||
);
|
||||
return $this->rate_limit_response( \__( 'Too many client registration requests. Please try again later.', 'activitypub' ) );
|
||||
}
|
||||
$transient_key = 'ap_oauth_reg_' . \md5( $ip );
|
||||
$count = (int) \get_transient( $transient_key );
|
||||
|
||||
if ( $count >= 10 ) {
|
||||
return new \WP_Error(
|
||||
'activitypub_rate_limited',
|
||||
\__( 'Too many client registration requests. Please try again later.', 'activitypub' ),
|
||||
array( 'status' => 429 )
|
||||
);
|
||||
return $this->rate_limit_response( \__( 'Too many client registration requests. Please try again later.', 'activitypub' ) );
|
||||
}
|
||||
|
||||
\set_transient( $transient_key, $count + 1, MINUTE_IN_SECONDS );
|
||||
@ -183,4 +175,25 @@ class Clients_Controller extends \WP_REST_Controller {
|
||||
array( 'Content-Type' => 'application/json' )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Build a 429 rate-limit response with a Retry-After header.
|
||||
*
|
||||
* @since 9.0.0
|
||||
*
|
||||
* @param string $message Translated human-readable error message.
|
||||
* @return \WP_REST_Response
|
||||
*/
|
||||
private function rate_limit_response( $message ) {
|
||||
return new \WP_REST_Response(
|
||||
array(
|
||||
'code' => 'activitypub_rate_limited',
|
||||
'message' => $message,
|
||||
'data' => array( 'status' => 429 ),
|
||||
),
|
||||
429,
|
||||
// RFC 6585 §4: send Retry-After so clients can back off.
|
||||
array( 'Retry-After' => (string) MINUTE_IN_SECONDS )
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user