[issue2551197] Login limit needs to protect REST and xmlrpc as well.

New submission from John Rouillard:

The rate limit mechanism only protects the html web interface as it's tied to the 
LoginAction::handle() method.

Rate limiting should be pushed down to LoginAction::verifyLogin which is called by
determine_user() in the inner_main, handle_rest and handle_xmlrpc methods in client.py.

For this ticket, we will just reuse the existing client.db.config.WEB_LOGIN_ATTEMPTS_MIN
setting for all three http based password access methods. I see no reason to have different
number of attempts depending on the method.

----------
assignee: rouilj
components: API
messages: 7463
nosy: rouilj
severity: normal
status: new
title: Login limit needs to protect REST and xmlrpc as well.
type: security

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551197>
_________________________________________________