Limit request by ip address - without rest key (chriskacerguis#711)

erayakartuna · chriskacerguis · commit 706f3b8375a0 · 2016-09-28T21:39:04.000-05:00
diff --git a/application/config/rest.php b/application/config/rest.php
@@ -334,6 +334,7 @@
 | Specify the method used to limit the API calls
 |
 | Available methods are :
+| $config['rest_limits_method'] = 'IP_ADDRESS'; // Put a limit per ip address
 | $config['rest_limits_method'] = 'API_KEY'; // Put a limit per api key
 | $config['rest_limits_method'] = 'METHOD_NAME'; // Put a limit on method calls
 | $config['rest_limits_method'] = 'ROUTED_URL';  // Put a limit on the routed URL
diff --git a/application/language/bulgarian/rest_controller_lang.php b/application/language/bulgarian/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'API ключът не е оторизиран зо достъп до заявения контролер';
 $lang['text_rest_api_key_permissions'] = 'API ключът няма достатъчно права';
 $lang['text_rest_api_key_time_limit'] = 'API ключът е изполван с превишаване на времевия лимит за този метод';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Неизвестен метод';
 $lang['text_rest_unsupported'] = 'Неподдържан протокол';
diff --git a/application/language/english/rest_controller_lang.php b/application/language/english/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'This API key does not have access to the requested controller';
 $lang['text_rest_api_key_permissions'] = 'This API key does not have enough permissions';
 $lang['text_rest_api_key_time_limit'] = 'This API key has reached the time limit for this method';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';
 $lang['text_rest_unknown_method'] = 'Unknown method';
 $lang['text_rest_unsupported'] = 'Unsupported protocol';
diff --git a/application/language/french/rest_controller_lang.php b/application/language/french/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Cette clef d\'API n\'a pas accès au contrôleur demandé';
 $lang['text_rest_api_key_permissions'] = 'Cette clef d\'API n\'a pas les permissions requises';
 $lang['text_rest_api_key_time_limit'] = 'Cette clef d\'API a atteint sa limite de temps pour cette méthode';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Méthode inconnue';
 $lang['text_rest_unsupported'] = 'Protocole non-supporté';
diff --git a/application/language/german/rest_controller_lang.php b/application/language/german/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Dieser API Schlüssel hat keinen Zugriff auf den angeforderten Controller';
 $lang['text_rest_api_key_permissions'] = 'Dieser API Schlüssel besitzt die erforderlichen Rechte nicht';
 $lang['text_rest_api_key_time_limit'] = 'Dieser API Schlüssel ist abgelaufen';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Unbekannte Methode';
 $lang['text_rest_unsupported'] = 'Protokoll nicht unterstützt';
diff --git a/application/language/greek/rest_controller_lang.php b/application/language/greek/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Αυτό το API key δεν έχει πρόσβαση στον συγκεκριμένο controller';
 $lang['text_rest_api_key_permissions'] = 'Αυτό το API key δεν έχει αρκετά δικαιώματα';
 $lang['text_rest_api_key_time_limit'] = 'Αυτό το API key έχει φτάσει στο μέγιστο όριο requests για την συγκεκριμένη μέθοδο';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Άγνωστη μέθοδος';
 $lang['text_rest_unsupported'] = 'Το συγκεκριμένο πρωτόκολλο δεν υποστηρίζεται';
diff --git a/application/language/portuguese-brazilian/rest_controller_lang.php b/application/language/portuguese-brazilian/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Esta chave da API não tem acesso ao controller solicitado';
 $lang['text_rest_api_key_permissions'] = 'Esta chave da API não tem permissões suficientes';
 $lang['text_rest_api_key_time_limit'] = 'Esta chave da API já atingiu o tempo limite para este método';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Método desconhecido';
 $lang['text_rest_unsupported'] = 'Sem suporte para este protocolo';
diff --git a/application/language/romanian/rest_controller_lang.php b/application/language/romanian/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Această cheie API nu are acees la controller-ul solicitat';
 $lang['text_rest_api_key_permissions'] = 'Această cheie API nu are suficiente permisiuni';
 $lang['text_rest_api_key_time_limit'] = 'Această cheie API a atins limita de timp pentru această metodă';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Metodă necunoscută';
 $lang['text_rest_unsupported'] = 'Protocol neacceptat';
diff --git a/application/language/serbian_cyr/rest_controller_lang.php b/application/language/serbian_cyr/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Овај *API* кључ нема овлашћења за захтевани контролер';
 $lang['text_rest_api_key_permissions'] = 'Овај *API* кључ нема дозвољен степен овлашћења';
 $lang['text_rest_api_key_time_limit'] = 'Овај *API* кључ је прекорачио временски лимит за дати метод';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Непознат метод';
 $lang['text_rest_unsupported'] = 'Неподржан протокол';
diff --git a/application/language/serbian_lat/rest_controller_lang.php b/application/language/serbian_lat/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Ovaj API klju&#269; nema ovla&#353;&#263;enje za zahtevani kontroler';
 $lang['text_rest_api_key_permissions'] = 'Ovaj API klju&#269; nema dozvoljen stepen ovla&#353;&#263;enja';
 $lang['text_rest_api_key_time_limit'] = 'Ovaj API klju&#269; je prekora&#269;io vremenski limit za dati metod';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'Nepoznat metod';
 $lang['text_rest_unsupported'] = 'Nepodr&#382;an protokol';
diff --git a/application/language/simplified-chinese/rest_controller_lang.php b/application/language/simplified-chinese/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = '此 API key无法存取指定的 controller';
 $lang['text_rest_api_key_permissions'] = '此 API key没有足够的权限';
 $lang['text_rest_api_key_time_limit'] = '此 API key已经超过有效期限';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = '未知的方法';
 $lang['text_rest_unsupported'] = '不支持的请求方法';
diff --git a/application/language/spanish/rest_controller_lang.php b/application/language/spanish/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Esta clave de API no tiene acceso al controlador solicitado';
 $lang['text_rest_api_key_permissions'] = 'Esta clave de API no tiene suficientes permisos';
 $lang['text_rest_api_key_time_limit'] = 'Esta clave de API ha alcanzado el límite de tiempo para este método';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = 'método desconocido';
 $lang['text_rest_unsupported'] = 'Protocolo no soportado';
diff --git a/application/language/traditional-chinese/rest_controller_lang.php b/application/language/traditional-chinese/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = '這個 API 金鑰沒有辦法存取指定的 controller';
 $lang['text_rest_api_key_permissions'] = '這個 API 金鑰沒有具備足夠權限';
 $lang['text_rest_api_key_time_limit'] = '這個 API 金鑰已經超過有效期限';
+$lang['text_rest_ip_address_time_limit'] = 'This IP Address has reached the time limit for this method';//todo translate
 $lang['text_rest_unknown_method'] = '未知的方法';
 $lang['text_rest_unsupported'] = '不支援的通訊協定';
diff --git a/application/language/turkish/rest_controller_lang.php b/application/language/turkish/rest_controller_lang.php
@@ -13,5 +13,6 @@
 $lang['text_rest_api_key_unauthorized'] = 'Ulaşılmak istenilen controllera API anahtarının erişim yetkisi bulunmamaktadır';
 $lang['text_rest_api_key_permissions'] = 'Bu API anahtarının yeterli yetkisi bulunmamaktadır';
 $lang['text_rest_api_key_time_limit'] = 'API anahtarı bu metod için zaman sınırına ulaştı.';
+$lang['text_rest_ip_address_time_limit'] = 'IP adresi bu metod için zaman sınırına ulaştı.';
 $lang['text_rest_unknown_method'] = 'Bilinmeyen metod';
 $lang['text_rest_unsupported'] = 'Desteklenmeyen protokol';
diff --git a/application/libraries/REST_Controller.php b/application/libraries/REST_Controller.php
@@ -704,6 +704,13 @@ public function _remap($object_called, $arguments = [])
             }
         }
 
+        //check request limit by ip without login
+        elseif ($this->config->item('rest_limits_method') == "IP_ADDRESS" && $this->config->item('rest_enable_limits') && $this->_check_limit($controller_method) === FALSE)
+        {
+            $response = [$this->config->item('rest_status_field_name') => FALSE, $this->config->item('rest_message_field_name') => $this->lang->line('text_rest_ip_address_time_limit')];
+            $this->response($response, self::HTTP_UNAUTHORIZED);
+        }
+
         // No key stuff, but record that stuff is happening
         elseif ($this->config->item('rest_enable_logging') && $log_method)
         {
@@ -1129,10 +1136,17 @@ protected function _check_limit($controller_method)
             return TRUE;
         }
 
+        $api_key = isset($this->rest->key) ? $this->rest->key : '';
+
         switch ($this->config->item('rest_limits_method'))
         {
+          case 'IP_ADDRESS':
+            $limited_uri = 'ip-address:' .$this->input->ip_address();
+            $api_key = $this->input->ip_address();
+            break;
+
           case 'API_KEY':
-            $limited_uri = 'api-key:' . (isset($this->rest->key) ? $this->rest->key : '');
+            $limited_uri = 'api-key:' . $api_key;
             break;
 
           case 'METHOD_NAME':
@@ -1164,7 +1178,7 @@ protected function _check_limit($controller_method)
         // Get data about a keys' usage and limit to one row
         $result = $this->rest->db
             ->where('uri', $limited_uri)
-            ->where('api_key', $this->rest->key)
+            ->where('api_key', $api_key)
             ->get($this->config->item('rest_limits_table'))
             ->row();
 
@@ -1174,7 +1188,7 @@ protected function _check_limit($controller_method)
             // Create a new row for the following key
             $this->rest->db->insert($this->config->item('rest_limits_table'), [
                 'uri' => $limited_uri,
-                'api_key' => isset($this->rest->key) ? $this->rest->key : '',
+                'api_key' =>$api_key,
                 'count' => 1,
                 'hour_started' => time()
             ]);
@@ -1186,7 +1200,7 @@ protected function _check_limit($controller_method)
             // Reset the started period and count
             $this->rest->db
                 ->where('uri', $limited_uri)
-                ->where('api_key', isset($this->rest->key) ? $this->rest->key : '')
+                ->where('api_key', $api_key)
                 ->set('hour_started', time())
                 ->set('count', 1)
                 ->update($this->config->item('rest_limits_table'));
@@ -1204,7 +1218,7 @@ protected function _check_limit($controller_method)
             // Increase the count by one
             $this->rest->db
                 ->where('uri', $limited_uri)
-                ->where('api_key', $this->rest->key)
+                ->where('api_key', $api_key)
                 ->set('count', 'count + 1', FALSE)
                 ->update($this->config->item('rest_limits_table'));
         }

Original file line number	Diff line number	Diff line change
`@@ -334,6 +334,7 @@`
`334`	`334`	`\| Specify the method used to limit the API calls`
`335`	`335`	`\|`
`336`	`336`	`\| Available methods are :`
	`337`	`+\| $config['rest_limits_method'] = 'IP_ADDRESS'; // Put a limit per ip address`
`337`	`338`	`\| $config['rest_limits_method'] = 'API_KEY'; // Put a limit per api key`
`338`	`339`	`\| $config['rest_limits_method'] = 'METHOD_NAME'; // Put a limit on method calls`
`339`	`340`	`\| $config['rest_limits_method'] = 'ROUTED_URL'; // Put a limit on the routed URL`