create_ticket_api.php: no rate limiting on external Bearer-key endpoint #27

New Issue

2026-08-31T21:29:38-04:00

jared commented

2026-08-31 21:29:38 -04:00

Severity: High

create_ticket_api.php is missing RateLimitMiddleware::apply('api'), which every other endpoint (including the other two Bearer endpoints ticket_status_api.php and ticket_comment_api.php) calls at the top of the file.

README.md:104 claims the whole Bearer API is "rate-limited" — this endpoint contradicts that.

Impact: Anyone with a leaked/guessed API key (or even a pre-auth flood — ApiKeyAuth::authenticate() still does a SHA-256 hash + DB SELECT per request before rejecting) can hammer ticket creation unthrottled. Each insert also fires a Matrix webhook via NotificationHelper::sendTicketNotification, so this can spam the Matrix room and/or run the DB/webhook target into the ground.

Fix: Add require_once .../RateLimitMiddleware.php; RateLimitMiddleware::apply('api'); near the top of create_ticket_api.php, before the DB connection is opened, matching the other Bearer endpoints.

**Severity:** High `create_ticket_api.php` is missing `RateLimitMiddleware::apply('api')`, which every other endpoint (including the other two Bearer endpoints `ticket_status_api.php` and `ticket_comment_api.php`) calls at the top of the file. README.md:104 claims the whole Bearer API is "rate-limited" — this endpoint contradicts that. **Impact:** Anyone with a leaked/guessed API key (or even a pre-auth flood — `ApiKeyAuth::authenticate()` still does a SHA-256 hash + DB SELECT per request before rejecting) can hammer ticket creation unthrottled. Each insert also fires a Matrix webhook via `NotificationHelper::sendTicketNotification`, so this can spam the Matrix room and/or run the DB/webhook target into the ground. **Fix:** Add `require_once .../RateLimitMiddleware.php; RateLimitMiddleware::apply('api');` near the top of `create_ticket_api.php`, before the DB connection is opened, matching the other Bearer endpoints.