Password reset: ratelimit by IP

r2/r2/controllers/api.py

@@ -2723,13 +2723,19 @@ class ApiController(RedditController):
                                errors.NO_TEXT):
             form.redirect("/gold/thanks?v=%s" % status)
 
-    @validatedForm(user = VUserWithEmail('name'))
+    @validatedForm(
+        VRatelimit(rate_ip=True, prefix="rate_password_"),
+        user=VUserWithEmail('name'),
+    )
     def POST_password(self, form, jquery, user):
         if form.has_errors('name', errors.USER_DOESNT_EXIST):
             return
         elif form.has_errors('name', errors.NO_EMAIL_FOR_USER):
             return
+        elif form.has_errors('ratelimit', errors.RATELIMIT):
+            return
         else:
+            VRatelimit.ratelimit(rate_ip=True, prefix="rate_password_")
             if emailer.password_email(user):
                 form.set_html(".status",
                       _("an email will be sent to that account's address shortly"))

r2/r2/templates/password.html

@@ -39,6 +39,7 @@
     <input type="text" name="name" />
     ${error_field("USER_DOESNT_EXIST", "name")}
     ${error_field("NO_EMAIL_FOR_USER", "name")}
+    ${error_field("RATELIMIT", "ratelimit")}
   </%utils:round_field>
 </div>