feat: Pageload rate-limiting by IP for donate page
This commit implements basic measures against attacks that operate by rapidly accessing the site through HTTP.
- The package
django-ratelimit
was added to thepyproject.toml
manifest andpoetry.lock
was regenerated in turn. - In
settings.py
, we define a simple backend cache for Django to use. Because Django shares Redis with CiviCRM, we are only utilizing this cache for the purposes of givingdjango-ratelimit
a backend in order to keep that shared pool unpolluted and traffic low. In the future, if it is desirable, use of this backend cache could be expanded to cover actual page cacheing, etc. - The URL pattern defined for the donate page in
urls.py
wraps theDonateFormView.as_view()
call in aratelimit
call which defines the method rate-limited against, the method by which access is tracked (in this case, "ip"), and the allowed rate of access.