Alan Guo Xiang Tan 439cc5b023 SECURITY: Impose a upper bound on limit params in various controllers ... What is the problem here? In multiple controllers, we are accepting a `limit` params but do not impose any upper bound on the values being accepted. Without an upper bound, we may be allowing arbituary users from generating DB queries which may end up exhausing the resources on the server. What is the fix here? A new `fetch_limit_from_params` helper method is introduced in `ApplicationController` that can be used by controller actions to safely get the limit from the params as a default limit and maximum limit has to be set. When an invalid limit params is encountered, the server will respond with the 400 response code.		2023-07-28 12:56:35 +01:00
..
admin	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
users	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
about_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
application_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
associated_groups_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
badges_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bookmarks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
bootstrap_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
categories_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
clicks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
composer_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
composer_messages_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
csp_reports_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_columns_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
directory_items_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
do_not_disturb_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
drafts_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
edit_directory_columns_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
email_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
embed_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
exceptions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
export_csv_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
extra_locales_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
finish_installation_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
forums_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
groups_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
hashtags_controller.rb	FEATURE: Allow showing hashtag autocomplete results without term (#19219)	2022-12-08 13:47:59 +10:00
highlight_js_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
inline_onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
invites_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
list_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
metadata_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
new_topic_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
notifications_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
offline_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
onebox_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
permalinks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_action_users_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
post_actions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
post_readers_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
posts_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
presence_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
published_pages_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
push_notification_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
qunit_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
reviewable_claimed_topics_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
reviewables_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
robots_txt_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
safe_mode_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
search_controller.rb	FEATURE: rate limit anon searches per second (#19708)	2023-02-01 19:05:58 -08:00
session_controller.rb	FIX: Ruby 2 backward compatible plugin logout redirect (#19845)	2023-01-25 13:48:49 +02:00
similar_topics_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
site_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
sitemap_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
static_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
steps_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
stylesheets_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
svg_sprite_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
tag_groups_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
tags_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
theme_javascripts_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
topics_controller.rb	SECURITY: Prevent dismissal of topics that user can't see (#22090)	2023-06-13 11:10:10 -06:00
uploads_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_actions_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_api_keys_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_avatars_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_badges_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
user_status_controller.rb	FEATURE: User Status API (#19149)	2022-11-24 19:16:28 +04:00
users_controller.rb	SECURITY: Impose a upper bound on limit params in various controllers	2023-07-28 12:56:35 +01:00
users_email_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
webhooks_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00
wizard_controller.rb	DEV: Apply syntax_tree formatting to app/*	2023-01-09 14:14:59 +00:00