Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/spec/serializers
History
Alan Guo Xiang Tan bfc3132bb2
SECURITY: Impose a upper bound on limit params in various controllers 
What is the problem here?

In multiple controllers, we are accepting a `limit` params but do not
impose any upper bound on the values being accepted. Without an upper
bound, we may be allowing arbituary users from generating DB queries
which may end up exhausing the resources on the server.

What is the fix here?

A new `fetch_limit_from_params` helper method is introduced in
`ApplicationController` that can be used by controller actions to safely
get the limit from the params as a default limit and maximum limit has
to be set. When an invalid limit params is encountered, the server will
respond with the 400 response code.
 		2023-07-28 12:53:46 +01:00
..
about_serializer_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
admin_plugin_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
admin_user_action_serializer_spec.rb FIX: Show topic titles in deleted-posts (#19610) 2022-12-28 16:07:06 +08:00
admin_user_list_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
basic_group_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
basic_group_user_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
basic_post_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
basic_reviewable_flagged_post_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
basic_reviewable_queued_post_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
basic_reviewable_serializer_spec.rb DEV: Add reviewables tab to the new user menu (#17630) 2022-07-28 11:16:33 +03:00
basic_reviewable_user_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
basic_user_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
basic_user_with_status_serializer_spec.rb DEV: move BasicUserWithStatusSerializer from Discourse Chat (#18745) 2022-10-26 16:41:31 +04:00
category_detailed_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
category_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
category_upload_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
current_user_serializer_spec.rb DEV: Remove legacy user menu (#21308) 2023-05-17 09:16:42 -07:00
detailed_user_badge_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
directory_item_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
emoji_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
found_user_serializer_spec.rb DEV: return user IDs on the user search route (#21206) 2023-04-25 18:25:57 +04:00
found_user_with_status_serializer_spec.rb DEV: return user status on the user search route (#17716) 2022-08-09 14:54:33 +04:00
group_show_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
group_user_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
invite_serializer_spec.rb FIX: Hide delete button to invite as user are unable to delete anyway (#21884) 2023-06-06 12:24:19 +08:00
listable_topic_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
new_post_result_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
notification_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
pending_post_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
post_revision_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
post_serializer_spec.rb FEATURE: Implement SiteSetting to Allow Anonymous Likes (#22131) 2023-07-21 21:21:07 +08:00
poster_serializer_spec.rb FIX: Include group flair in homepage category topic lists (#21268) 2023-04-27 10:18:16 +08:00
reviewable_flagged_post_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
reviewable_queued_post_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
reviewable_score_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
reviewable_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
reviewable_user_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
single_sign_on_record_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
site_serializer_spec.rb UX: Display tag's description as title in navigation menu (#22710) 2023-07-24 08:07:37 +08:00
suggested_topic_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
tag_group_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
tag_serializer_spec.rb SECURITY: Default tags to show count of topics in unrestricted categories (#19916) 2023-01-20 09:50:24 +08:00
theme_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
topic_link_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
topic_list_item_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
topic_list_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
topic_tracking_state_item_serializer_spec.rb DEV: Improve MessageBus subscriptions for TopicTrackingState (#19767) 2023-02-01 07:18:45 +08:00
topic_tracking_state_serializer_spec.rb DEV: Improve MessageBus subscriptions for TopicTrackingState (#19767) 2023-02-01 07:18:45 +08:00
topic_view_details_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
topic_view_posts_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
topic_view_serializer_spec.rb DEV: Remove Discourse.redis.delete_prefixed (#22103) 2023-06-16 12:44:35 +10:00
upload_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
user_auth_token_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
user_badge_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
user_bookmark_list_serializer_spec.rb SECURITY: Impose a upper bound on limit params in various controllers 2023-07-28 12:53:46 +01:00
user_card_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
user_post_bookmark_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
user_serializer_spec.rb FEATURE: Split navigation preference for count and behavior of sidebar links (#22203) 2023-06-22 19:04:13 +03:00
user_summary_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
web_hook_post_serializer_spec.rb FIX: Show auto-group flair according to user preferences (#21221) 2023-04-24 16:04:26 -03:00
web_hook_topic_view_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
web_hook_user_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
wizard_serializer_spec.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00