Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce pagination (or at least limits) for arbitrary custom SQL #69

Closed
simonw opened this issue Nov 12, 2017 · 4 comments
Closed

Enforce pagination (or at least limits) for arbitrary custom SQL #69

simonw opened this issue Nov 12, 2017 · 4 comments

Comments

@simonw
Copy link
Owner

simonw commented Nov 12, 2017

It's way too easy to accidentally trigger a page that returns 100,000 rows at the moment. I need to use the LIMIT clause on views and custom SQL - I can support pagination "next" links using offset as well.

@simonw simonw added the medium label Nov 12, 2017
@simonw simonw added this to the Ship v1 milestone Nov 12, 2017
@simonw
Copy link
Owner Author

simonw commented Nov 12, 2017

By default I'll allow LIMIT and OFFSET up to a maximum of X (where X is let's say 50,000 to start with, but can be custom configured to a larger number or set to None for no limit).

@simonw simonw changed the title Enforce pagination (or at least limits) for views and for arbitrary custom SQL Enforce pagination (or at least limits) for arbitrary custom SQL Nov 12, 2017
@simonw
Copy link
Owner Author

simonw commented Nov 13, 2017

I think the only safe way to do this is using SQLite .fetchmany(1000) - I can't guarantee that the user has not entered SQL that will outfox a limit in some way. So instead of attempting to edit their SQL, I'll always return 1001 records and let them know if they went over 1000 or not.

@simonw
Copy link
Owner Author

simonw commented Nov 13, 2017

I'm going with a page size of 100 and a max limit of 1000

@simonw simonw closed this as completed in 8252e71 Nov 13, 2017
@simonw
Copy link
Owner Author

simonw commented Nov 13, 2017

ak

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant