Removing/rate-limiting the "Test Mail" button.

SKevo

Hello,

Flarum beta.14 has added a new feature to the admin panel that allows you to send a test mail to test the configuration.

However, this could cause issues at host like FreeFlarum, where an user can just spam the mail button multiple times in a row. This could lead to our mail being treated as spam. Is there a way we can limit the button rate or remove the button completely (eg. by using extend.php)?

luceos

First response: 🙈

Second response: you can use the ThrottleApi extender. @askvortsov wrote that one, so he might know about how to best use it. But something like:

(new Flarum\Extend\ThrottleApi)->set('throttleMailTests', function ($request) {
    if ($request->getAttribute('routeName') === 'mailTest') {
        return true;
    }
 })

SKevo

Thanks, but that produces the following error:

PHP message: PHP Fatal error:  Uncaught Error: Class 'Flarum\Extend\ThrottleApi' not found [...]

Do I need to import it first? Not a PHP coder here...

askvortsov

It's not available in beta 14, only starting with beta 15.

SKevo

Is there any way we can remove the button and method entirely until beta.15 arrives?

askvortsov

You could configure the web server to block the route on that level? Or use a local extender to add a Middleware blocking the route there. For the actual button, hiding it with CSS might be the easiest step

SKevo

askvortsov

Thank you, I think that CSS will be enough to get it away from someone's eyes. I don't think that anyone will speculate to bypass that.