Необходимо выводить рекаптчу после нескольких неудачных попыток аутентификации.
Алгоритм выбрал такой:
Для каждого пользователя хранить в базе счетчик неправильных попыток и сбрасывать его при правильном логине,если счетчик больше 3 то показывать каптчку
Код.
Попытка авторизации:
if request.method == 'POST':
form = AuthForm(request.POST)
if form.is_valid():
username = form.cleaned_data['username']
password = form.cleaned_data['password']
user = authenticate(username=username, password=password)
user = authenticate(username=username, password=password)
if user is not None:
if user.is_active:
login(request, user)
#Redirect to a success page.
return HttpResponseRedirect('/')
else:
# Return a 'disabled account' error message
return render_to_response('login.html', {'form' : form, 'error_login': 1})
else:
if Badlogin.objects.filter(username = username):
p = Badlogin.objects.get(username = username)
if p.count < 3:
p.count +=1
p.save()
return render_to_response('registration/login.html', {'form' : form, 'error_login': 1})
else:
p = Badlogin(username = username, count = 1)
p.save()
return render_to_response('registration/login.html', {'form' : form, 'error_login': 1})
check_captcha = captcha.submit(request.POST['recaptcha_challenge_field'],
request.POST['recaptcha_response_field'],
settings.RECAPTCHA_PRIVATE_KEY, request.META['REMOTE_ADDR'])
if check_captcha.is_valid is False:
form = AuthForm()
return render_to_response('login.html', {'form' : form, 'error_captcha' : 1, 'html_captcha' : html_captcha})
Весь код:
from django import forms
from recaptcha.client import captcha
from django.conf import settings
from django.shortcuts import render_to_response
from django.contrib.auth import authenticate, login
from django.http import HttpResponseRedirect
from callme.models import Badlogin
class AuthForm(forms.Form):
username = forms.CharField()
password = forms.CharField(widget=forms.PasswordInput())
html_captcha = captcha.displayhtml(settings.RECAPTCHA_PUB_KEY)
def auth(request):
if request.method == 'POST':
form = AuthForm(request.POST)
if form.is_valid():
username = form.cleaned_data['username']
password = form.cleaned_data['password']
if Badlogin.objects.filter(username = username, count = 3):
check_captcha = captcha.submit(request.POST['recaptcha_challenge_field'], request.POST['recaptcha_response_field'], settings.RECAPTCHA_PRIVATE_KEY, request.META['REMOTE_ADDR'])
if check_captcha.is_valid is False:
form = AuthForm()
return render_to_response('registration/login.html', {'form' : form, 'error_captcha' : 1, 'html_captcha' : html_captcha})
user = authenticate(username=username, password=password)
if user is not None:
if user.is_active:
login(request, user)
# Redirect to a success page.
return HttpResponseRedirect('/')
else:
# Return a 'disabled account' error message
return render_to_response('registration/login.html', {'form' : form, 'error_login': 1})
else:
# Return an 'invalid login' error message.
if Badlogin.objects.filter(username = username):
p = Badlogin.objects.get(username = username)
if p.count < 3:
p.count +=1
print p
p.save()
else:
p = Badlogin(username = username, count = 1)
p.save()
return render_to_response('registration/login.html', {'form' : form, 'error_login': 1})
else:
form = AuthForm()
return render_to_response('registration/login.html', {'form': form})