Save initial signup information for users to aid in spam prevention

models/user/user.go

@@ -120,6 +120,11 @@ type User struct {
 	// (ex: in private Gitea instances user won't be allowed to see even organizations/repositories that are set as public)
 	IsRestricted bool `xorm:"NOT NULL DEFAULT false"`
 
+	// Store the initial registration of the user, to aid in spam prevention
+	// Ensure that one IP isn't creating many accounts (following mediawiki approach)
+	InitialIP        string `xorm:"-"`
+	InitialUserAgent string `xorm:"-"`
+
 	AllowGitHook            bool
 	AllowImportLocal        bool // Allow migrate repository by local path
 	AllowCreateOrganization bool `xorm:"DEFAULT true"`
@@ -745,6 +750,20 @@ func createUser(ctx context.Context, u *User, createdByAdmin bool, overwriteDefa
 		return err
 	}
 
+	// insert initial IP and UserAgent
+	if err = SetUserSetting(ctx, u.ID, "initial_ip", u.InitialIP); err != nil {
+		return err
+	}
+
+	// trim user agent string to a reasonable length, if necessary
+	userAgent := strings.TrimSpace(u.InitialUserAgent)
+	if len(userAgent) > 255 {
+		userAgent = userAgent[:255]
+	}
+	if err = SetUserSetting(ctx, u.ID, "initial_user_agent", userAgent); err != nil {
+		return err
+	}
+
 	// insert email address
 	if err := db.Insert(ctx, &EmailAddress{
 		UID:         u.ID,

routers/web/auth/auth.go

@@ -541,6 +541,8 @@ func createAndHandleCreatedUser(ctx *context.Context, tpl base.TplName, form any
 // createUserInContext creates a user and handles errors within a given context.
 // Optionally a template can be specified.
 func createUserInContext(ctx *context.Context, tpl base.TplName, form any, u *user_model.User, overwrites *user_model.CreateUserOverwriteOptions, gothUser *goth.User, allowLink bool) (ok bool) {
+	u.InitialIP = ctx.RemoteAddr()
+	u.InitialUserAgent = ctx.Req.UserAgent()
 	if err := user_model.CreateUser(ctx, u, overwrites); err != nil {
 		if allowLink && (user_model.IsErrUserAlreadyExist(err) || user_model.IsErrEmailAlreadyUsed(err)) {
 			if setting.OAuth2Client.AccountLinking == setting.OAuth2AccountLinkingAuto {

services/context/access_log.go

@@ -86,6 +86,7 @@ func AccessLogger() func(http.Handler) http.Handler {
 				ResponseWriter: rw,
 				Ctx: map[string]any{
 					"RemoteAddr": req.RemoteAddr,
+					"UserAgent":  req.UserAgent,
 					"RemoteHost": reqHost,
 					"Req":        req,
 				},