✨ Fix #13

controller/blacklistmidware.go

@@ -0,0 +1,37 @@
+// Pipe - A small and beautiful blogging platform written in golang.
+// Copyright (C) 2017-present, b3log.org
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package controller
+
+import (
+	"github.com/88250/pipe/cron"
+	"github.com/88250/pipe/util"
+	"github.com/gin-gonic/gin"
+	"net/http"
+)
+
+func blacklist(c *gin.Context) {
+	clientIP := util.GetRemoteAddr(c)
+
+	if _, ok := cron.BlacklistIPs[clientIP]; ok {
+		c.Header("Retry-After", "600")
+		c.Data(http.StatusTooManyRequests, "text/html; charset=utf-8", []byte("Too Many Requests"))
+		c.Abort()
+		return
+	}
+
+	c.Next()
+}

controller/router.go

@@ -177,17 +177,17 @@ func MapRoutes() *gin.Engine {
 	templates = append(templates, headTemplates...)
 	ret.LoadHTMLFiles(templates...)
 	themeGroup := ret.Group(util.PathBlogs + "/:username")
-	themeGroup.Use(fillUser, pjax, resolveBlog)
+	themeGroup.Use(blacklist, fillUser, pjax, resolveBlog)
 	themeGroup.GET("", showArticlesAction)
 	themeGroup.Any("/*path", routePath)
 
 	adminPagesGroup := ret.Group(util.PathAdmin)
-	adminPagesGroup.Use(fillUser)
+	adminPagesGroup.Use(blacklist, fillUser)
 	adminPagesGroup.GET("", console.ShowAdminPagesAction)
 	adminPagesGroup.GET("/*path", console.ShowAdminPagesAction)
 
 	indexGroup := ret.Group("")
-	indexGroup.Use(fillUser)
+	indexGroup.Use(blacklist, fillUser)
 	indexGroup.GET("", showIndexAction)
 	indexGroup.GET(util.PathChangelogs, showChangelogsAction)
 

cron/blacklistcron.go

@@ -25,7 +25,7 @@ import (
 )
 
 // BlacklistIPs saves all banned IPs.
-var BlacklistIPs []string
+var BlacklistIPs map[string]bool
 
 func refreshBlacklistIPsPeriodically() {
 	go refreshBlacklistIPs()
@@ -49,10 +49,9 @@ func refreshBlacklistIPs() {
 		return
 	}
 
+	BlacklistIPs = map[string]bool{}
 	dataIPs := result["data"].([]interface{})
-	var ips []string
 	for _, dataIP := range dataIPs {
-		ips = append(ips, dataIP.(string))
+		BlacklistIPs[dataIP.(string)] = false
 	}
-	BlacklistIPs = ips
 }