Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/app/controllers/admin
History
Alan Guo Xiang Tan bfc3132bb2
SECURITY: Impose a upper bound on limit params in various controllers 
What is the problem here?

In multiple controllers, we are accepting a `limit` params but do not
impose any upper bound on the values being accepted. Without an upper
bound, we may be allowing arbituary users from generating DB queries
which may end up exhausing the resources on the server.

What is the fix here?

A new `fetch_limit_from_params` helper method is introduced in
`ApplicationController` that can be used by controller actions to safely
get the limit from the params as a default limit and maximum limit has
to be set. When an invalid limit params is encountered, the server will
respond with the 400 response code.
 		2023-07-28 12:53:46 +01:00
..
admin_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
api_controller.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
backups_controller.rb SECURITY: Rate limit the creation of backups 2023-03-16 16:09:22 +01:00
badges_controller.rb UX: Easily toggle badges in admin badge list (#20225) 2023-02-09 11:36:27 -08:00
color_schemes_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
dashboard_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
email_controller.rb DEV: Replace raw comments with deprecation warnings (#22617) 2023-07-18 10:13:40 +08:00
email_styles_controller.rb FEATURE: customization of html emails (#7934) 2019-07-30 15:05:08 -04:00
email_templates_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
embeddable_hosts_controller.rb FEATURE: Update topic/comment embedding parameters (#20181) 2023-02-28 14:31:59 +02:00
embedding_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
emojis_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
form_templates_controller.rb DEV: Show form templates in the composer (#21190) 2023-05-29 14:47:18 -07:00
groups_controller.rb DEV: Fix random typos (#22345) 2023-06-29 12:23:28 +02:00
impersonate_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
permalinks_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
plugins_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
reports_controller.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
robots_txt_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
screened_emails_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
screened_ip_addresses_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
screened_urls_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
search_logs_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
site_settings_controller.rb FEATURE: Add default site settings to control the defaults of navigation menu preferences (#22485) 2023-07-07 04:52:10 +03:00
site_texts_controller.rb DEV: Add endpoint for dismissing outdated translations (#22509) 2023-07-19 23:06:13 +08:00
staff_action_logs_controller.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
staff_controller.rb Refactor admin base controller (#18453) 2022-10-31 12:02:26 +00:00
themes_controller.rb DEV: Refactor updating parent/child relationships between themes (#22244) 2023-06-22 13:57:39 -05:00
user_fields_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
users_controller.rb DEV: Move distance_of_time_in_words/time_ago_in_words (#21745) 2023-05-25 14:53:59 +02:00
versions_controller.rb Refactor admin base controller (#18453) 2022-10-31 12:02:26 +00:00
watched_words_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00
web_hooks_controller.rb DEV: Apply syntax_tree formatting to `app/*` 2023-01-09 14:14:59 +00:00