fix(search): Limit maximum number of search results

Signed-off-by: Joas Schilling <coding@schilljs.com>

diff --git a/core/Controller/UnifiedSearchController.php b/core/Controller/UnifiedSearchController.php
index 469c6c6ed7bf40a2c0224fd4b129089c649e8ecc..3df7749ce723a5cb7dc34f43c3e5f5436842545f 100644 (file)
--- a/core/Controller/UnifiedSearchController.php
+++ b/core/Controller/UnifiedSearchController.php
@@ -92,7 +92,7 @@ class UnifiedSearchController extends OCSController {
         * @param string $providerId ID of the provider
         * @param string $term Term to search
         * @param int|null $sortOrder Order of entries
-        * @param int|null $limit Maximum amount of entries
+        * @param int|null $limit Maximum amount of entries, limited to 25
         * @param int|string|null $cursor Offset for searching
         * @param string $from The current user URL
         *
@@ -113,6 +113,9 @@ class UnifiedSearchController extends OCSController {
        ): DataResponse {
                [$route, $routeParameters] = $this->getRouteInformation($from);
 
+               $limit ??= SearchQuery::LIMIT_DEFAULT;
+               $limit = max(1, min($limit, 25));
+
                try {
                        $filters = $this->composer->buildFilterList($providerId, $this->request->getParams());
                } catch (UnsupportedFilter|InvalidArgumentException $e) {
@@ -125,7 +128,7 @@ class UnifiedSearchController extends OCSController {
                                new SearchQuery(
                                        $filters,
                                        $sortOrder ?? ISearchQuery::SORT_DATE_DESC,
-                                       $limit ?? SearchQuery::LIMIT_DEFAULT,
+                                       $limit,
                                        $cursor,
                                        $route,
                                        $routeParameters

diff --git a/core/openapi.json b/core/openapi.json
index 37c32cb74042b6c4f7b5dd575c08cf01dfc93db9..34009e38472d7df7fa769576c54277b0d7628905 100644 (file)
--- a/core/openapi.json
+++ b/core/openapi.json
@@ -5366,7 +5366,7 @@
                     {
                         "name": "limit",
                         "in": "query",
-                        "description": "Maximum amount of entries",
+                        "description": "Maximum amount of entries, limited to 25",
                         "schema": {
                             "type": "integer",
                             "format": "int64",