diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index d64c46a2cd..4dc69b7850 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -1,5 +1,7 @@ check() && App::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled') { + $isPreviliggedUser = Auth::isPreviliggedUser(Authorization::$roles); + $isAppUser = Auth::isAppUser(Authorization::$roles); + + if (($abuse->check() // Route is rate-limited + && App::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled') // Abuse is not diabled + && (!$isAppUser && !$isPreviliggedUser)) // User is not an admin or API key + { throw new Exception('Too many requests', 429); } }, ['utopia', 'request', 'response', 'project', 'user', 'register'], 'api'); \ No newline at end of file