Abort User Application key creation if there are already pending one

For security, we should prevent to create many keys because at that point the
user is not authenticated and so the system could be abused.
The measure is to prevent to create per user more than one pending key.

issue5958
review29651002

trytond/res/routes.py

@@ -29,11 +29,13 @@ def user_application(request, pool):
             logger.info('User Application not found: %s', data.get('user'))
             return abort(404)
         user, = users
+        if UserApplication.count(user.id):
+            logger.info('User Application has already a request: %s', login)
+            return abort(429)
         data['user'] = user.id
         data.pop('key', None)
         data.pop('state', None)
         application, = UserApplication.create([data])
-        time.sleep(2 ** UserApplication.count(application))
         return application.key
     elif request.method == 'DELETE':
         time.sleep(2 ** LoginAttempt.count(login) - 1)

trytond/res/user.py

@@ -755,9 +755,9 @@ class UserApplication(Workflow, ModelSQL, ModelView):
         pass
 
     @classmethod
-    def count(cls, application):
+    def count(cls, user_id):
         return cls.search([
-                ('user', '=', application.user.id),
+                ('user', '=', user_id),
                 ('state', '=', 'requested'),
                 ], count=True)