diff --git a/apps/meteor/app/api/server/helpers/parseJsonQuery.ts b/apps/meteor/app/api/server/helpers/parseJsonQuery.ts index 807f72080e4bb..f96e3a46f7fbf 100644 --- a/apps/meteor/app/api/server/helpers/parseJsonQuery.ts +++ b/apps/meteor/app/api/server/helpers/parseJsonQuery.ts @@ -107,8 +107,16 @@ export async function parseJsonQuery(api: PartialThis): Promise<{ } } + const allowedRoutes = [ + '/api/v1/settings.public', + '/api/v1/directory', + '/api/v1/channels.messages', + '/api/v1/groups.messages', + '/api/v1/dm.messages', + '/api/v1/im.messages', + ]; let query: Record = {}; - if (params.query && isUnsafeQueryParamsAllowed) { + if (params.query && (isUnsafeQueryParamsAllowed || allowedRoutes.includes(route))) { apiDeprecationLogger.parameter(route, 'query', '8.0.0', response, messageGenerator); try { query = ejson.parse(params.query);