Merge branch 'feature/pentest'

-LOGIN_TIMES_LIMIT = 100
+LOGIN_TIMES_LIMIT = 10
 LOGIN_TIMES_LIMIT_EXPIRES = 3600 * 24
 

@@ -27,15 +27,15 @@ class LoginView(ObtainJSONWebToken, GenericView):
     def post(self, request, *args, **kwargs):
         # 登录次数限制
         user_name = request.data.get('username', '')
-        # times = rh.get_login_times(user_name)
-        # if isinstance(times, int) and times >= LOGIN_TIMES_LIMIT:
-        #     raise self.invalid_params(msg="重试次数限制")
+        times = rh.get_login_times(user_name)
+        if isinstance(times, int) and times >= LOGIN_TIMES_LIMIT:
+            raise self.invalid_params(msg="重试次数限制")
 
         res = super(LoginView, self).post(request, *args, **kwargs)
         self.running_log.info('[users.login] username: {0}'.format(user_name))
 
         if res.status_code == status.HTTP_400_BAD_REQUEST:
-            # rh.set_login_times(user_name, LOGIN_TIMES_LIMIT_EXPIRES)
+            rh.set_login_times(user_name, LOGIN_TIMES_LIMIT_EXPIRES)
             raise self.invalid_params(msg="用户名或密码错误")
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid()

@@ -1390,10 +1390,10 @@ class AutoSettlementView(GenericView):
 
 
 class AutoSettlementExcelView(GenericView):
-    permission_classes = []
-    authentication_classes = []
-    # permission_classes = [IsAuthenticated]
-    # authentication_classes = [OAuth2AuthenticationWithUser]
+    # permission_classes = []
+    # authentication_classes = []
+    permission_classes = [IsAuthenticated]
+    authentication_classes = [OAuth2AuthenticationWithUser]
 
     # 获取auto settlement excel
     @use_args(auto_list_args, location='querystring')

@@ -161,6 +161,9 @@ REST_FRAMEWORK = {
     'EXCEPTION_HANDLER': 'common.exceptions.exception_handler'
 }
 
+# session配置
+SESSION_COOKIE_AGE = 1800
+
 # 日志配置
 LOGGING_CONFIG = None
 config.fileConfig(conf.LOGGING_CONFIG_FILE, disable_existing_loggers=False)