mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-03 20:07:47 +08:00
b99859cfc5
Non-admin users with group-level query access could pass `limit=ALL` or an arbitrarily large integer to bypass the row limit cap on data explorer queries. This commit removes support for the `ALL` value for the `limit` query param since it is unbounded. We consider this a security hardening fix instead of a security flaw since there are many conditions for this code path to be exploited and those conditions are quite rare.
11 lines
335 B
Ruby
11 lines
335 B
Ruby
# frozen_string_literal: true
|
|
|
|
task "javascript:update_constants" => :environment do
|
|
write_template(
|
|
"../plugins/discourse-data-explorer/assets/javascripts/discourse/lib/constants.js",
|
|
"update_constants",
|
|
<<~JS,
|
|
export const QUERY_RESULT_MAX_LIMIT = #{DiscourseDataExplorer::QUERY_RESULT_MAX_LIMIT};
|
|
JS
|
|
)
|
|
end
|
