diff --git a/server/channels/api4/remote_cluster.go b/server/channels/api4/remote_cluster.go index 8183e21728..186b47163e 100644 --- a/server/channels/api4/remote_cluster.go +++ b/server/channels/api4/remote_cluster.go @@ -218,6 +218,13 @@ func uploadRemoteData(c *Context, w http.ResponseWriter, r *http.Request) { return } + // Apply same security restrictions as normal upload API + if us.Type == model.UploadTypeImport { + c.Err = model.NewAppError("uploadRemoteData", "api.remote_cluster.import_not_allowed.app_error", + nil, "", http.StatusBadRequest) + return + } + info, err := doUploadData(c, us, r) if err != nil { c.Err = err diff --git a/server/i18n/en.json b/server/i18n/en.json index b3f4d5b123..789ae0a4b8 100644 --- a/server/i18n/en.json +++ b/server/i18n/en.json @@ -2878,6 +2878,10 @@ "id": "api.remote_cluster.get.not_found", "translation": "Remote Cluster not found" }, + { + "id": "api.remote_cluster.import_not_allowed.app_error", + "translation": "Remote cluster import is not allowed" + }, { "id": "api.remote_cluster.invalid_id.app_error", "translation": "Invalid id."