hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(mastodon_api): rate limit status actions per status id

Browse source 
StatusController keeps string param keys (replace_params: false, since
b8db67daf), so params: [:id] never matched and status_id_action became
one bucket per user across all statuses (3 favourites/reblogs a minute).
This commit is contained in:
Lain Soykaf 2026-10-30 10:36:05 +04:00
commit 53b79781da
No known key found for this signature in database
3 changed files with 26 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/pleroma/web/mastodon_api/controllers/status_controller.ex
View file

@ -92,13 +92,13 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
plug(
RateLimiter,
[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: [:id]]
[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: ["id"]]
when action in ~w(reblog unreblog)a
)
plug(
RateLimiter,
[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: [:id]]
[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: ["id"]]
when action in ~w(favourite unfavourite)a
)