hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(pleroma_api): rate limit emoji reactions

Browse source 
The emoji reaction create and delete endpoints had no rate limiter.
Apply :statuses_actions like the other status actions, plus a per-status
:status_id_action bucket ("status_id_action:emoji_react") in the same way
favourite and reblog do.
This commit is contained in:
Lain Soykaf 2026-10-30 10:20:43 +04:00
commit a4f1300578
No known key found for this signature in database
2 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
View file

@ -12,6 +12,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
alias Pleroma.Web.CommonAPI
alias Pleroma.Web.MastodonAPI.StatusView
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.Plugs.RateLimiter
plug(Pleroma.Web.ApiSpec.CastAndValidate)
plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action in [:create, :delete])
@ -22,6 +23,14 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
when action == :index
)
plug(
RateLimiter,
[name: :status_id_action, bucket_name: "status_id_action:emoji_react", params: [:id]]
when action in [:create, :delete]
)
plug(RateLimiter, [name: :statuses_actions] when action in [:create, :delete])
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.EmojiReactionOperation
action_fallback(Pleroma.Web.MastodonAPI.FallbackController)