From 728298d2f5f8f643c4b60bba25fbdbb888aa9ef5 Mon Sep 17 00:00:00 2001
From: Chirag Aggarwal <chiragaggarwal5k@gmail.com>
Date: Tue, 12 May 2026 13:23:39 +0530
Subject: [PATCH] Address abuse timelimit review comments

---
 app/controllers/shared/api.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index 6a63fab3a6..7b7d394908 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -546,6 +546,11 @@ Http::init()
         $roles = $authorization->getRoles();
         $isPrivilegedUser = $user->isPrivileged($roles);
         $isAppUser = $user->isApp($roles);
+        $enabled = System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled';
+        $shouldCheckAbuse = $enabled
+            && ! $isAppUser
+            && ! $isPrivilegedUser
+            && $devKey->isEmpty();
 
         foreach ($timeLimitArray as $timeLimit) {
             foreach ($request->getParams() as $key => $value) { // Set request params as potential abuse keys
@@ -556,11 +561,6 @@ Http::init()
 
             $abuse = new Abuse($timeLimit);
 
-            $enabled = System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled';
-            $shouldCheckAbuse = $enabled
-                && ! $isAppUser
-                && ! $isPrivilegedUser
-                && $devKey->isEmpty();
             $isRateLimited = false;
 
             try {
@@ -585,7 +585,7 @@ Http::init()
             }
 
             if (
-                $shouldCheckAbuse       // Abuse is enabled and the user is rate-limited
+                $shouldCheckAbuse       // Abuse is enabled and caller is not privileged/app/dev
                 && $isRateLimited       // Route is rate-limited
             ) {
                 throw new Exception(Exception::GENERAL_RATE_LIMIT_EXCEEDED);