Merge pull request #273 from mattermost/mm-1355

Fixes mm-1355 adds rate limiting apis

api/user.go

@@ -284,13 +284,32 @@ func LoginByEmail(c *Context, w http.ResponseWriter, r *http.Request, email, nam
 }
 
 func checkUserPassword(c *Context, user *model.User, password string) bool {
+
+	if user.FailedAttempts >= utils.Cfg.ServiceSettings.AllowedLoginAttempts {
+		c.LogAuditWithUserId(user.Id, "fail")
+		c.Err = model.NewAppError("checkUserPassword", "Your account is locked because of too many failed password attempts. Please reset your password.", "user_id="+user.Id)
+		c.Err.StatusCode = http.StatusForbidden
+		return false
+	}
+
 	if !model.ComparePassword(user.Password, password) {
 		c.LogAuditWithUserId(user.Id, "fail")
 		c.Err = model.NewAppError("checkUserPassword", "Login failed because of invalid password", "user_id="+user.Id)
 		c.Err.StatusCode = http.StatusForbidden
+
+		if result := <-Srv.Store.User().UpdateFailedPasswordAttempts(user.Id, user.FailedAttempts+1); result.Err != nil {
+			c.LogError(result.Err)
+		}
+
 		return false
+	} else {
+		if result := <-Srv.Store.User().UpdateFailedPasswordAttempts(user.Id, 0); result.Err != nil {
+			c.LogError(result.Err)
+		}
+
+		return true
 	}
-	return true
+
 }
 
 // User MUST be validated before calling Login