external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(rpc): limit Package results, not relationships

Browse source 
...This was an obvious bug in hindsight. Apologies :(

Closes #314

Signed-off-by: Kevin Morris <kevr@0cost.org>
This commit is contained in:
Kevin Morris 2022-02-23 14:06:07 -08:00
parent 1e31db47ab
commit 51d4b7f993
No known key found for this signature in database
GPG key ID: F7E46DED420788F3
2 changed files with 19 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
aurweb/rpc.py
View file

@ -202,7 +202,12 @@ class RPC:
models.User.ID == models.PackageBase.MaintainerUID,
isouter=True
).filter(models.Package.Name.in_(args))
packages = self._entities(packages)
max_results = config.getint("options", "max_rpc_results")
packages = self._entities(packages).limit(max_results + 1)
if packages.count() > max_results:
raise RPCError("Too many package results.")
ids = {pkg.ID for pkg in packages}
@ -274,12 +279,7 @@ class RPC:
]
# Union all subqueries together.
max_results = config.getint("options", "max_rpc_results")
query = subqueries[0].union_all(*subqueries[1:]).limit(
max_results + 1).all()
if len(query) > max_results:
raise RPCError("Too many package results.")
query = subqueries[0].union_all(*subqueries[1:]).all()
# Store our extra information in a class-wise dictionary,
# which contains package id -> extra info dict mappings.