Add submission rate limit to prevent abuse

Author: kiritofeng

dmoj/settings.py

@@ -76,6 +76,10 @@
 DMOJ_SUBMISSION_LIMIT = 2
 DMOJ_SUBMISSIONS_REJUDGE_LIMIT = 10
 
+# Rate limit submissions to prevent abuse
+DMOJ_SUBMISSION_RATELIMIT_TIMEFRAME = datetime.timedelta(days=1)
+DMOJ_SUBMISSION_RATELIMIT = 500
+
 # Whether to allow users to view source code: 'all' | 'all-solved' | 'only-own'
 DMOJ_SUBMISSION_SOURCE_VISIBILITY = 'all-solved'
 DMOJ_BLOG_NEW_PROBLEM_COUNT = 7

judge/views/problem.py

@@ -695,12 +695,16 @@ def get_success_url(self):
         return reverse('submission_status', args=(self.new_submission.id,))
 
     def form_valid(self, form):
-        if (
-            not self.request.user.has_perm('judge.spam_submission') and
-            Submission.objects.filter(user=self.request.profile, rejudged_date__isnull=True)
-                              .exclude(status__in=['D', 'IE', 'CE', 'AB']).count() >= settings.DMOJ_SUBMISSION_LIMIT
-        ):
-            return HttpResponse(format_html('<h1>{0}</h1>', _('You submitted too many submissions.')), status=429)
+        if not self.request.user.has_perm('judge.spam_submission'):
+            if (
+                Submission.objects.filter(user=self.request.profile, rejudged_date__isnull=True)
+                    .exclude(status__in=['D', 'IE', 'CE', 'AB']).count() >= settings.DMOJ_SUBMISSION_LIMIT
+            ) or (
+                Submission.objects.filter(user=self.request.profile,
+                                          date__gte=timezone.now() - settings.DMOJ_SUBMISSION_RATELIMIT_TIMEFRAME)
+                    .exclude(status__in=['IE', 'CE']).count() >= settings.DMOJ_SUBMISSION_RATELIMIT
+            ):
+                return HttpResponse(format_html('<h1>{0}</h1>', _('You submitted too many submissions.')), status=429)
         if not self.object.allowed_languages.filter(id=form.cleaned_data['language'].id).exists():
             raise PermissionDenied()
         if not self.request.user.is_superuser and self.object.banned_users.filter(id=self.request.profile.id).exists():