diff --git a/packages/rocketchat-authorization/server/startup.js b/packages/rocketchat-authorization/server/startup.js index 3fe7771125de..1cf5ef494a2b 100644 --- a/packages/rocketchat-authorization/server/startup.js +++ b/packages/rocketchat-authorization/server/startup.js @@ -46,6 +46,7 @@ Meteor.startup(function() { { _id: 'run-migration', roles : ['admin'] }, { _id: 'set-moderator', roles : ['admin', 'owner'] }, { _id: 'set-owner', roles : ['admin', 'owner'] }, + { _id: 'send-many-messages', roles : ['admin', 'bot'] }, { _id: 'unarchive-room', roles : ['admin'] }, { _id: 'view-c-room', roles : ['admin', 'user', 'bot', 'anonymous'] }, { _id: 'user-generate-access-token', roles : ['admin'] }, diff --git a/packages/rocketchat-lib/server/methods/sendMessage.js b/packages/rocketchat-lib/server/methods/sendMessage.js index 2f6e41502fc5..698136ba0614 100644 --- a/packages/rocketchat-lib/server/methods/sendMessage.js +++ b/packages/rocketchat-lib/server/methods/sendMessage.js @@ -68,14 +68,8 @@ Meteor.methods({ } }); // Limit a user, who does not have the "bot" role, to sending 5 msgs/second -DDPRateLimiter.addRule({ - type: 'method', - name: 'sendMessage', +RocketChat.RateLimiter.limitMethod('sendMessage', 5, 1000, { userId(userId) { - const user = RocketChat.models.Users.findOneById(userId); - if (user == null || !user.roles) { - return true; - } - return user.roles.includes('bot'); + return !RocketChat.authz.hasPermission(userId, 'send-many-messages'); } -}, 5, 1000); +});