Discource-C/discourse
1
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-07 03:48:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Only apply the rate limit to user exports, not downloads (#30965)

Browse Source 
Follow-up to 7fc8d74f3eed52116add452b5321b41e02e04499.

This change moves the guardian check for whether an export has been generated too recently to the endpoint handler, since we only want this check to apply when generating an export.
This commit is contained in:
Gary Pendergast 2025-01-24 09:37:05 +11:00 committed by GitHub
parent 7fc8d74f3e
commit 7d2fcb8812
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
app/controllers/export_csv_controller.rb
View File

@ -17,6 +17,17 @@ class ExportCsvController < ApplicationController
if entity == "user_archive" if entity == "user_archive"
requesting_user_id = current_user.id if entity_id requesting_user_id = current_user.id if entity_id
# Rate limit user archive exports to 1 per day
unless current_user.admin ||
UserExport.where(
user_id: entity_id || current_user.id,
created_at: (Time.zone.now.beginning_of_day..Time.zone.now.end_of_day),
).count == 0
render_json_error I18n.t("csv_export.rate_limit_error")
return
end
Jobs.enqueue( Jobs.enqueue(
:export_user_archive, :export_user_archive,
user_id: entity_id || current_user.id, user_id: entity_id || current_user.id,

6
lib/guardian.rb
View File

@ -544,11 +544,7 @@ class Guardian
# Regular users can only export their archives # Regular users can only export their archives
return false unless entity == "user_archive" return false unless entity == "user_archive"
return false unless entity_id == @user.id || entity_id.nil? entity_id == @user.id || entity_id.nil?
UserExport.where(
user_id: @user.id,
created_at: (Time.zone.now.beginning_of_day..Time.zone.now.end_of_day),
).count == 0
end end
def can_see_emails? def can_see_emails?