From c5f79bba09a14d5e40adc35b1bf0e49f1b08bb46 Mon Sep 17 00:00:00 2001
From: catalintomai <56169943+catalintomai@users.noreply.github.com>
Date: Wed, 18 Jun 2025 15:49:58 +0200
Subject: [PATCH] MM-64610: Restrict import upload for shared channels feature.
 (#31659)

---
 server/channels/api4/remote_cluster.go | 7 +++++++
 server/i18n/en.json                    | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/server/channels/api4/remote_cluster.go b/server/channels/api4/remote_cluster.go
index 8183e21728..186b47163e 100644
--- a/server/channels/api4/remote_cluster.go
+++ b/server/channels/api4/remote_cluster.go
@@ -218,6 +218,13 @@ func uploadRemoteData(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Apply same security restrictions as normal upload API
+	if us.Type == model.UploadTypeImport {
+		c.Err = model.NewAppError("uploadRemoteData", "api.remote_cluster.import_not_allowed.app_error",
+			nil, "", http.StatusBadRequest)
+		return
+	}
+
 	info, err := doUploadData(c, us, r)
 	if err != nil {
 		c.Err = err
diff --git a/server/i18n/en.json b/server/i18n/en.json
index b3f4d5b123..789ae0a4b8 100644
--- a/server/i18n/en.json
+++ b/server/i18n/en.json
@@ -2878,6 +2878,10 @@
     "id": "api.remote_cluster.get.not_found",
     "translation": "Remote Cluster not found"
   },
+  {
+    "id": "api.remote_cluster.import_not_allowed.app_error",
+    "translation": "Remote cluster import is not allowed"
+  },
   {
     "id": "api.remote_cluster.invalid_id.app_error",
     "translation": "Invalid id."