Merge pull request #239 from purplebird/csv_attack

CSV attack fix

wger/weight/helpers.py

@@ -47,6 +47,8 @@ def parse_weight_csv(request, cleaned_data):
     entry_dates = set()
     weight_list = []
     error_list = []
+    MAX_ROW_COUNT = 1000
+    row_count = 0
 
     # Process the CSV items first
     for row in parsed_csv:
@@ -69,6 +71,9 @@ def parse_weight_csv(request, cleaned_data):
 
         except (ValueError, IndexError, decimal.InvalidOperation):
             error_list.append(row)
+        row_count += 1
+        if row_count > MAX_ROW_COUNT:
+            break
 
     # Create the valid weight entries
     for date, weight in distinct_weight_entries:

wger/weight/templates/import_csv_form.html

@@ -22,7 +22,7 @@
 <p>{% blocktrans %}You can copy and paste from your spreadsheet into the text input,
 the system will try to guess the format to import. The only things to consider is
 that the first column is the <strong>date</strong>, the second the <strong>weight</strong>.
-All further columns are ignored.
+All further columns are ignored. There is a 1000 row limit.
 {% endblocktrans %}</p>
 
 <p>{% blocktrans %}If there are errors, you can correct or discard them in a