misskey-dev / misskey

🌎 An interplanetary microblogging platform 🚀
https://misskey-hub.net/
GNU Affero General Public License v3.0
9.63k stars 1.28k forks source link

API `i/import-user-lists` can bypass `userListLimit` role policy #14035

Open SWREI opened 1 week ago

SWREI commented 1 week ago

💡 Summary

User can create lists by importing their lists from other server. (can't bypass userEachUserListsLimit at all by importing is using same method)

🥰 Expected Behavior

User can't import their list due to role policy

🤬 Actual Behavior

User can import their list unlimited

📝 Steps to Reproduce

  1. set userListLimit value to 0
  2. import any list from other instance

💻 Frontend Environment

* Model and OS of the device(s): Windows 11 23H2 (22631.3737)
* Browser: Chrome 125.0.6422.176
* Server URL: oscar.surf (but not server related)
* Misskey: 2024.5.0-oscar.1a

🛰 Backend Environment (for server admin)

* Installation Method or Hosting Service: systemd
* Misskey: 2024.5.0-oscar.1a
* Node: 20.11.1
* PostgreSQL: 15.6-1.pgdg22.04+1
* Redis: 7.2.4
* OS and Architecture: Ubuntu 22.04.4 LTS aarch64

Do you want to address this bug yourself?