Review notes

src/pretix/base/forms/auth.py

@@ -84,7 +84,9 @@ class LoginForm(forms.Form):
 
     def clean(self):
         if all(k in self.cleaned_data for k, f in self.fields.items() if f.required):
-            if rate_limit("login", include_ip_from_request=self.request, max_num=10, expire_time=300):
+            rate_limit_kwargs = dict(include_ip_from_request=self.request, max_num=10, expire_time=300)
+            if rate_limit("login", **rate_limit_kwargs, increase=False):
+                # Check rate limit without counting up, we increase below only on failed logins
                 pretix_failed_logins.inc(1, reason="ratelimit")
                 logger.info("Backend login rejected due to rate limit.")
                 raise forms.ValidationError(self.error_messages['rate_limit'], code='rate_limit')
@@ -92,6 +94,8 @@ class LoginForm(forms.Form):
             if self.user_cache is None:
                 logger.info("Backend login invalid.")
                 pretix_failed_logins.inc(1, reason="invalid")
+                # Count towards rate limit (result is ignored, we are checking above)
+                rate_limit("login", **rate_limit_kwargs)
                 raise forms.ValidationError(
                     self.error_messages['invalid_login'],
                     code='invalid_login'

src/pretix/base/forms/user.py

@@ -177,10 +177,19 @@ class UserEmailChangeForm(forms.Form):
 
     def __init__(self, *args, **kwargs):
         self.user = kwargs.pop('user')
+        self.request = kwargs.pop('request')
         super().__init__(*args, **kwargs)
 
     def clean_new_email(self):
         email = self.cleaned_data['new_email']
+
+        if rate_limit("emailchange_attempt", include_ip_from_request=self.request, max_num=5, expire_time=300):
+            # Rate limit lookup for conflicting email addresses to make enumeration harder
+            raise forms.ValidationError(
+                self.error_messages['rate_limit'],
+                code='rate_limit',
+            )
+
         if User.objects.filter(Q(email__iexact=email) & ~Q(pk=self.user.pk)).exists():
             raise forms.ValidationError(
                 self.error_messages['duplicate_identifier'],