Pierre-Yves David <pierre-yves.david@logilab.fr> [Wed, 20 Mar 2013 17:40:25 +0100] rev 8743
3.16 is the new stable
After discussion with David Douard I'm merging 3.16.x branches in stable and
starting 3.17 feature on default.
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 16:56:46 +0100] rev 8742
Added tag cubicweb-debian-version-3.15.10-1 for changeset feca12e4a618
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 16:56:45 +0100] rev 8741
Added tag cubicweb-version-3.15.10 for changeset 89bdb5444cd2
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 16:56:28 +0100] rev 8740
prepare 3.15.10
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 16:54:32 +0100] rev 8739
Added tag cubicweb-debian-version-3.16.1-1 for changeset 84fbcdc8021c
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 16:54:31 +0100] rev 8738
Added tag cubicweb-version-3.16.1 for changeset d95cbb7349f0
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 16:53:57 +0100] rev 8737
prepare 3.16.1
Aurelien Campeas <aurelien.campeas@logilab.fr> [Tue, 19 Mar 2013 15:30:06 +0100] rev 8736
[views/primary] some inner sections should use the `limit` by default to avoid a denial of service (closes #2719110)
Today, it is possible to call .related and get a huge unlimited
database-dos-inducing resultset that will be nevertheless limited a
bit further in pure python in the `autolimited` view.
While we cannot completely avoid potential denial of services such as
these we mitigate the problem with the default ui settings: if the
inner vid is `autolimited`, then the relation result sets is computed
using the user-defined limit.
This change respects the semantics of the `autolimited` view and
shouldn't break anything.