From: Joas Schilling <coding@schilljs.com>
Date: Wed, 15 May 2024 07:47:22 +0000 (+0200)
Subject: fix(search): Limit maximum number of search results
X-Git-Tag: v29.0.1rc1~8^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=refs%2Fpull%2F45318%2Fhead;p=nextcloud-server.git

fix(search): Limit maximum number of search results

Signed-off-by: Joas Schilling <coding@schilljs.com>
---

diff --git a/core/Controller/UnifiedSearchController.php b/core/Controller/UnifiedSearchController.php
index 469c6c6ed7b..3df7749ce72 100644
--- a/core/Controller/UnifiedSearchController.php
+++ b/core/Controller/UnifiedSearchController.php
@@ -92,7 +92,7 @@ class UnifiedSearchController extends OCSController {
 	 * @param string $providerId ID of the provider
 	 * @param string $term Term to search
 	 * @param int|null $sortOrder Order of entries
-	 * @param int|null $limit Maximum amount of entries
+	 * @param int|null $limit Maximum amount of entries, limited to 25
 	 * @param int|string|null $cursor Offset for searching
 	 * @param string $from The current user URL
 	 *
@@ -113,6 +113,9 @@ class UnifiedSearchController extends OCSController {
 	): DataResponse {
 		[$route, $routeParameters] = $this->getRouteInformation($from);
 
+		$limit ??= SearchQuery::LIMIT_DEFAULT;
+		$limit = max(1, min($limit, 25));
+
 		try {
 			$filters = $this->composer->buildFilterList($providerId, $this->request->getParams());
 		} catch (UnsupportedFilter|InvalidArgumentException $e) {
@@ -125,7 +128,7 @@ class UnifiedSearchController extends OCSController {
 				new SearchQuery(
 					$filters,
 					$sortOrder ?? ISearchQuery::SORT_DATE_DESC,
-					$limit ?? SearchQuery::LIMIT_DEFAULT,
+					$limit,
 					$cursor,
 					$route,
 					$routeParameters
diff --git a/core/openapi.json b/core/openapi.json
index 37c32cb7404..34009e38472 100644
--- a/core/openapi.json
+++ b/core/openapi.json
@@ -5366,7 +5366,7 @@
                     {
                         "name": "limit",
                         "in": "query",
-                        "description": "Maximum amount of entries",
+                        "description": "Maximum amount of entries, limited to 25",
                         "schema": {
                             "type": "integer",
                             "format": "int64",