Newer users may not extend their session until seasoned. (#1906)

* Also bump out limiter for captcha * Plethora of bad actors today. Post #944 Auto-merge
OpenUserJS · Dec 24, 2021 · f4f102a · f4f102a
1 parent d3e174c
commit f4f102a
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 2 deletions.
diff --git a/controllers/user.js b/controllers/user.js
@@ -135,6 +135,14 @@ exports.extend = function (aReq, aRes, aNext) {
   }, function (aErr, aUser) {
     // WARNING: No err handling
 
+    if (aUser._probationary) {
+      statusCodePage(aReq, aRes, aNext, {
+        statusCode: 403,
+        statusMessage: 'Newer users may not extend their session.'
+      });
+      return;
+    }
+
     extendSession(aReq, aUser, function (aErr) {
       if (aErr) {
         if (aErr === 'Already extended') {

diff --git a/libs/modifySessions.js b/libs/modifySessions.js
@@ -249,7 +249,7 @@ exports.getSessionDataList = function (aReq, aOptions, aCallback) {
         var oujsOptions = session.passport.oujsOptions;
 
         session.showExtend = aReq.sessionID === oujsOptions.sid;
-        session.canExtend = !oujsOptions.extended;
+        session.canExtend = !oujsOptions.extended && !authedUser._probationary;
         session.canDestroyOne = true; // TODO: Perhaps do some further conditionals
 
         oujsOptions.remoteAddressMask = session.name === authedUser.name && !oujsOptions.authFrom

diff --git a/routes.js b/routes.js
@@ -37,7 +37,7 @@ var settings = require('./models/settings.json');
 
 //--
 
-var waitInstallMin = isDev ? 1 : 60;
+var waitInstallMin = isDev ? 1 : 360;
 var installLimiter = rateLimit({
   store: (isDev ? undefined : new MongoStore({
     uri: 'mongodb://127.0.0.1:27017/installLimiter',