Adds rate limit to /forgot. (getredash#5425)

Security vulnerability was disclosed by Sohail Ahmed <https://www.linkedin.com/in/sohail-ahmed-755776184/>

redash/handlers/authentication.py

@@ -148,6 +148,7 @@ def verify(token, org_slug=None):
 
 
 @routes.route(org_scoped_rule("/forgot"), methods=["GET", "POST"])
+@limiter.limit(settings.THROTTLE_PASS_RESET_PATTERN)
 def forgot_password(org_slug=None):
     if not current_org.get_setting("auth_password_login_enabled"):
         abort(404)

redash/settings/__init__.py

@@ -304,6 +304,7 @@ def email_server_is_configured():
 RATELIMIT_ENABLED = parse_boolean(os.environ.get("REDASH_RATELIMIT_ENABLED", "true"))
 THROTTLE_LOGIN_PATTERN = os.environ.get("REDASH_THROTTLE_LOGIN_PATTERN", "50/hour")
 LIMITER_STORAGE = os.environ.get("REDASH_LIMITER_STORAGE", REDIS_URL)
+THROTTLE_PASS_RESET_PATTERN = os.environ.get("REDASH_THROTTLE_PASS_RESET_PATTERN", "10/hour")
 
 # CORS settings for the Query Result API (and possibly future external APIs).
 # In most cases all you need to do is set REDASH_CORS_ACCESS_CONTROL_ALLOW_ORIGIN

tests/handlers/test_authentication.py

@@ -120,6 +120,16 @@ def test_throttle_login(self):
         response = self.get_request("/login", org=self.factory.org)
         self.assertEqual(response.status_code, 429)
 
+    def test_throttle_password_reset(self):
+        limiter.enabled = True
+        # Extract the limit from settings (ex: '10/hour')
+        limit = settings.THROTTLE_PASS_RESET_PATTERN.split("/")[0]
+        for _ in range(0, int(limit)):
+            self.get_request("/forgot", org=self.factory.org)
+
+        response = self.get_request("/forgot", org=self.factory.org)
+        self.assertEqual(response.status_code, 429)
+
 
 class TestSession(BaseTestCase):
     # really simple test just to trigger this route