diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index 4044ca1bfb..a9b11887df 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -115,11 +115,14 @@ App::init() ; } + $enabled = App::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled'; + if ( - (App::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled' // Route is rate-limited - && $abuse->check()) // Abuse is not disabled - && (!$isAppUser && !$isPrivilegedUser) - ) { // User is not an admin or API key + $enabled // Abuse is enabled + && !$isAppUser // User is not API key + && !$isPrivilegedUser // User is not an admin + && $abuse->check() // Route is rate-limited + ) { throw new Exception(Exception::GENERAL_RATE_LIMIT_EXCEEDED); } }