views: Limit max number of items per page to 1000

Allowing the users to set an arbitrary number of items per page may
cause excessive load on the database. For example, a request to the
patch list has to compute the number of tags for each listed patch.

Author: fstachura

patchwork/models.py

@@ -13,6 +13,7 @@
 from django.contrib.auth.models import User
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_unicode_slug
+from django.core.validators import MaxValueValidator
 from django.db import models
 from django.urls import reverse
 from django.utils.functional import cached_property
@@ -172,6 +173,7 @@ class UserProfile(models.Model):
         null=False,
         blank=False,
         help_text='Number of items to display per page',
+        validators=[MaxValueValidator(settings.MAX_ITEMS_PER_PAGE)],
     )
     show_ids = models.BooleanField(
         default=False,
@@ -208,6 +210,9 @@ def token(self):
         except Token.DoesNotExist:
             return
 
+    def get_items_per_page(self):
+        return min(self.items_per_page, settings.MAX_ITEMS_PER_PAGE)
+
     def todo_patches(self, project=None):
         # filter on project, if necessary
         if project:

patchwork/paginator.py

@@ -25,7 +25,7 @@ def __init__(self, request, objects):
         items_per_page = settings.DEFAULT_ITEMS_PER_PAGE
 
         if request.user.is_authenticated:
-            items_per_page = request.user.profile.items_per_page
+            items_per_page = request.user.profile.get_items_per_page()
 
         super().__init__(objects, items_per_page)
 

patchwork/settings/base.py

@@ -266,6 +266,8 @@
 REST_RESULTS_PER_PAGE = 30
 MAX_REST_RESULTS_PER_PAGE = 250
 
+MAX_ITEMS_PER_PAGE = 1000
+
 # Set to True to enable redirections or URLs from previous versions
 # of patchwork
 COMPAT_REDIR = True