langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Missing app quota check in app import API #12445

New Issue
Closed
opened 2026-02-21 19:07:26 -05:00 by yindo · 1 comment
yindo commented 2026-02-21 19:07:26 -05:00
Owner
Copy Link
Copy Source

Originally created by @1Ckpwee on GitHub (Apr 1, 2025).

Description\n\nThe app import API () is missing the app quota check that is present in other app creation endpoints. This could allow users to bypass the app creation limits by importing apps instead of creating them directly.\n\n## Current Behavior\n\n- Users can import apps without being checked against their subscription plan's app limit\n- This creates an inconsistency with the direct app creation endpoint which does enforce these limits\n\n## Expected Behavior\n\n- The app import API should enforce the same app quota limits as the direct app creation endpoint\n- Users should not be able to bypass their subscription plan's app limit through importing\n\n## Solution\n\nAdd the decorator to the method, similar to how it's implemented in the method.\n\n## Impact\n\nThis is a security issue as it allows users to bypass subscription plan limitations. It should be fixed to maintain consistent quota enforcement across all app creation methods.

Originally created by @1Ckpwee on GitHub (Apr 1, 2025). ## Description\n\nThe app import API () is missing the app quota check that is present in other app creation endpoints. This could allow users to bypass the app creation limits by importing apps instead of creating them directly.\n\n## Current Behavior\n\n- Users can import apps without being checked against their subscription plan's app limit\n- This creates an inconsistency with the direct app creation endpoint which does enforce these limits\n\n## Expected Behavior\n\n- The app import API should enforce the same app quota limits as the direct app creation endpoint\n- Users should not be able to bypass their subscription plan's app limit through importing\n\n## Solution\n\nAdd the decorator to the method, similar to how it's implemented in the method.\n\n## Impact\n\nThis is a security issue as it allows users to bypass subscription plan limitations. It should be fixed to maintain consistent quota enforcement across all app creation methods.
yindo closed this issue 2026-02-21 19:07:26 -05:00
yindo commented 2026-02-21 19:07:27 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Apr 1, 2025):

To address the issue of missing app quota checks in the app import API, you can add the cloud_edition_billing_resource_check("apps") decorator to the relevant method in the app import API. This decorator is used in other app creation endpoints to enforce app quota limits based on the user's subscription plan [1].

You should locate the method in the api/controllers/console/app/app_import.py file where the app import functionality is implemented and apply the decorator to ensure consistent quota enforcement across all app creation methods.

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (Apr 1, 2025): <!-- Answer --> To address the issue of missing app quota checks in the app import API, you can add the `cloud_edition_billing_resource_check("apps")` decorator to the relevant method in the app import API. This decorator is used in other app creation endpoints to enforce app quota limits based on the user's subscription plan <sup>[[1]](https://github.com/langgenius/dify/blob/main/api/controllers/console/wraps.py)</sup>. You should locate the method in the `api/controllers/console/app/app_import.py` file where the app import functionality is implemented and apply the decorator to ensure consistent quota enforcement across all app creation methods. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/87bcf564-e5a5-456d-9f5d-cd0c723c67af?feedback_type=other)</sup>
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#12445
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?