[views/primary] some inner sections should use the `limit` by default to avoid a denial of service (closes #2719110)
Today, it is possible to call .related and get a huge unlimited
database-dos-inducing resultset that will be nevertheless limited a
bit further in pure python in the `autolimited` view.
While we cannot completely avoid potential denial of services such as
these we mitigate the problem with the default ui settings: if the
inner vid is `autolimited`, then the relation result sets is computed
using the user-defined limit.
This change respects the semantics of the `autolimited` view and
shouldn't break anything.
# copyright 2003-2012 LOGILAB S.A. (Paris, FRANCE), all rights reserved.# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr## This file is part of CubicWeb.## CubicWeb is free software: you can redistribute it and/or modify it under the# terms of the GNU Lesser General Public License as published by the Free# Software Foundation, either version 2.1 of the License, or (at your option)# any later version.## CubicWeb is distributed in the hope that it will be useful, but WITHOUT# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more# details.## You should have received a copy of the GNU Lesser General Public License along# with CubicWeb. If not, see <http://www.gnu.org/licenses/>."""hooks to ensure use_email / primary_email relations consistency"""__docformat__="restructuredtext en"fromcubicweb.serverimporthookfromlogilab.common.compatimportanyclassSetUseEmailRelationOp(hook.Operation):"""delay this operation to commit to avoid conflict with a late rql query already setting the relation """rtype='use_email'entity=email=None# make pylint happydefcondition(self):"""check entity has use_email set for the email address"""returnnotany(eforeinself.entity.use_emailifself.email.eid==e.eid)defprecommit_event(self):ifself.condition():self.session.execute('SET X %s Y WHERE X eid %%(x)s, Y eid %%(y)s'%self.rtype,{'x':self.entity.eid,'y':self.email.eid})classSetPrimaryEmailRelationOp(SetUseEmailRelationOp):rtype='primary_email'defcondition(self):"""check entity has no primary_email set"""returnnotself.entity.primary_emailclassSetPrimaryEmailHook(hook.Hook):"""notify when a bug or story or version has its state modified"""__regid__='setprimaryemail'__select__=hook.Hook.__select__&hook.match_rtype('use_email')category='email'events=('after_add_relation',)def__call__(self):entity=self._cw.entity_from_eid(self.eidfrom)if'primary_email'inentity.e_schema.subject_relations():SetPrimaryEmailRelationOp(self._cw,entity=entity,email=self._cw.entity_from_eid(self.eidto))classSetUseEmailHook(hook.Hook):"""notify when a bug or story or version has its state modified"""__regid__='setprimaryemail'__select__=hook.Hook.__select__&hook.match_rtype('primary_email')category='email'events=('after_add_relation',)def__call__(self):entity=self._cw.entity_from_eid(self.eidfrom)if'use_email'inentity.e_schema.subject_relations():SetUseEmailRelationOp(self._cw,entity=entity,email=self._cw.entity_from_eid(self.eidto))