MM-64610: Restrict import upload for shared channels feature. (#31659)

server/channels/api4/remote_cluster.go

@@ -218,6 +218,13 @@ func uploadRemoteData(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Apply same security restrictions as normal upload API
+	if us.Type == model.UploadTypeImport {
+		c.Err = model.NewAppError("uploadRemoteData", "api.remote_cluster.import_not_allowed.app_error",
+			nil, "", http.StatusBadRequest)
+		return
+	}
+
 	info, err := doUploadData(c, us, r)
 	if err != nil {
 		c.Err = err

server/i18n/en.json

@@ -2878,6 +2878,10 @@
     "id": "api.remote_cluster.get.not_found",
     "translation": "Remote Cluster not found"
   },
+  {
+    "id": "api.remote_cluster.import_not_allowed.app_error",
+    "translation": "Remote cluster import is not allowed"
+  },
   {
     "id": "api.remote_cluster.invalid_id.app_error",
     "translation": "Invalid id."