From 507f9d6c6cb93fe68ef03b5904ccfe37ee9e1145 Mon Sep 17 00:00:00 2001 From: Prem Palanisamy Date: Fri, 22 May 2026 07:16:18 +0100 Subject: [PATCH] Require explicit endpoint + apiKey for external Appwrite sources --- src/Appwrite/Platform/Workers/Migrations.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/Appwrite/Platform/Workers/Migrations.php b/src/Appwrite/Platform/Workers/Migrations.php index 21cd54c04b..b37251faf6 100644 --- a/src/Appwrite/Platform/Workers/Migrations.php +++ b/src/Appwrite/Platform/Workers/Migrations.php @@ -214,6 +214,13 @@ class Migrations extends Action throw new Exception(Exception::MIGRATION_SOURCE_PROJECT_NOT_FOUND); } $projectDB = call_user_func($this->getProjectDB, $this->sourceProject); + } elseif ($this->sourceProject->isEmpty()) { + // External source — processMigration defaults missing endpoint/apiKey to this + // instance, which would silently self-call with the destination's key. Require + // explicit credentials so the failure mode is clear. + if (empty($credentials['endpoint']) || empty($credentials['apiKey'])) { + throw new Exception(Exception::MIGRATION_SOURCE_PROJECT_NOT_FOUND); + } } } $getDatabasesDB = fn (Document $database): Database =>