diff --git a/.changeset/proud-wolves-scream.md b/.changeset/proud-wolves-scream.md new file mode 100644 index 0000000000000..894e3e44e730d --- /dev/null +++ b/.changeset/proud-wolves-scream.md @@ -0,0 +1,5 @@ +--- +'@rocket.chat/meteor': patch +--- + +Fixes rate limiter not being enforced for the v1 REST API diff --git a/apps/meteor/app/api/server/ApiClass.ts b/apps/meteor/app/api/server/ApiClass.ts index 401023f92671b..e81788e6ec4a9 100644 --- a/apps/meteor/app/api/server/ApiClass.ts +++ b/apps/meteor/app/api/server/ApiClass.ts @@ -525,7 +525,7 @@ export class APIClass< invocation.twoFactorChecked = true; } - protected getFullRouteName(route: string, method: string): string { + public getFullRouteName(route: string, method: string): string { return `/${this.apiPath || ''}/${route}${method}`; } @@ -831,7 +831,7 @@ export class APIClass< const objectForRateLimitMatch = { IPAddr: this.requestIp, - route: `/${route}${this.request.method.toLowerCase()}`, + route: api.getFullRouteName(route, this.request.method.toLowerCase()), }; let result;