The UI will prevent user to move / delete more than 100 files (exact number still being defined). This is to prevent large scale undesired move or delete operations.
This could easily happen too via an API call. And here, there is no safeguard, API will execute. With the rise of agents and MCP, probably and risk is increasing a lot.
API consumer could easily:
- fire a move from
/project/en to something else (rename en root). This would rename the whole en tree with pretty serious impact. The large scale is not the only issue: this has an impact on the site logic itself
- fire a delete of
/project/en. UI converts the delete to a "move to trash". Directly using the delete api should be restricted or "safeguarded.
Not sure what is the best way to secure these operations.
The UI will prevent user to move / delete more than 100 files (exact number still being defined). This is to prevent large scale undesired move or delete operations.
This could easily happen too via an API call. And here, there is no safeguard, API will execute. With the rise of agents and MCP, probably and risk is increasing a lot.
API consumer could easily:
/project/ento something else (renameenroot). This would rename the wholeentree with pretty serious impact. The large scale is not the only issue: this has an impact on the site logic itself/project/en. UI converts the delete to a "move to trash". Directly using the delete api should be restricted or "safeguarded.Not sure what is the best way to secure these operations.