SECURITY: add rate limiting to anon JS error reporting

This adds a 1 minute rate limit to all JS error reporting per IP. Previously
we would only use the global rate limit.

This also introduces DISCOURSE_ENABLE_JS_ERROR_REPORTING, if it is set to
false then no JS error reporting will be allowed on the site.
This commit is contained in:
Sam Saffron
2019-08-20 11:29:11 +10:00
parent 0a5b332b8c
commit 8db38de9d7
5 changed files with 9 additions and 1 deletions

View File

@ -475,6 +475,7 @@ module ApplicationHelper
disable_custom_css: loading_admin?,
highlight_js_path: HighlightJs.path,
svg_sprite_path: SvgSprite.path(theme_ids),
enable_js_error_reporting: GlobalSetting.enable_js_error_reporting,
}
if Rails.env.development?