Add session pinning by country (#3233)

src/pretix/helpers/security.py

@@ -23,6 +23,10 @@ import hashlib
 import time
 
 from django.conf import settings
+from django.contrib.gis.geoip2 import GeoIP2
+from django.core.cache import cache
+
+from pretix.helpers.http import get_client_ip
 
 
 class SessionInvalid(Exception):
@@ -37,6 +41,19 @@ def get_user_agent_hash(request):
     return hashlib.sha256(request.headers['User-Agent'].encode()).hexdigest()
 
 
+_geoip = None
+
+
+def _get_country(request):
+    global _geoip
+
+    if not _geoip:
+        _geoip = GeoIP2()
+
+    res = _geoip.country(get_client_ip(request))
+    return res['country_code']
+
+
 def assert_session_valid(request):
     if not settings.PRETIX_LONG_SESSIONS or not request.session.get('pretix_auth_long_session', False):
         last_used = request.session.get('pretix_auth_last_used', time.time())
@@ -54,5 +71,16 @@ def assert_session_valid(request):
         else:
             request.session['pinned_user_agent'] = get_user_agent_hash(request)
 
+    if settings.HAS_GEOIP:
+        client_ip = get_client_ip(request)
+        hashed_client_ip = hashlib.sha256(client_ip.encode()).hexdigest()
+        country = cache.get_or_set(f'geoip_country_{hashed_client_ip}', lambda: _get_country(request), timeout=300)
+
+        if 'pinned_country' in request.session:
+            if request.session.get('pinned_country') != country:
+                raise SessionInvalid()
+        else:
+            request.session['pinned_country'] = country
+
     request.session['pretix_auth_last_used'] = int(time.time())
     return True