IP pseudonymization for rate limiter (#1589)

requirement of gdpr

classes/admin.php

@@ -367,6 +367,9 @@ class Admin
         $ipKey = Uri::ip();
         $redirect = isset($post['redirect']) ? $post['redirect'] : $this->base . $this->route;
 
+        // Pseudonymization of the IP
+        $ipKey = sha1($ipKey . $this->grav['config']->get('security.salt'));
+
         // Check if the current IP has been used in failed login attempts.
         $attempts = count($rateLimiter->getAttempts($ipKey, 'ip'));