https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42373 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 197512 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197512&action=edit Bug 42373: Enforce RESTMaxPatronsPageSize in patron list endpoint In a Koha instance with hundreds of thousands of patrons, an API request to /api/v1/patrons with _per_page=-1 can cause a single worker to query the database for all patrons, then make multiple additional queries per patron for decoration (fees owed, etc), effectively locking up that worker. This patch adds a new system preference RESTMaxPatronsPageSize. When set to a positive integer, requests to the /patrons list endpoint with _per_page=-1 or _per_page greater than the configured limit will be refused with HTTP 400 and error_code 'max_page_size_exceeded'. When left empty or set to 0, the existing behavior is preserved. Test Plan: 1) Apply this patch 2) Run updatedatabase.pl 3) Go to Administration > System preferences > Web services > REST API 4) Note the new RESTMaxPatronsPageSize preference 5) Leave RESTMaxPatronsPageSize empty 6) Make an API request: GET /api/v1/patrons?_per_page=-1 7) Note the request succeeds as before! 8) Set RESTMaxPatronsPageSize to 100 9) Make an API request: GET /api/v1/patrons?_per_page=-1 10) Note the request is rejected with a 400 and a clear error message! 11) Make an API request: GET /api/v1/patrons?_per_page=500 12) Note the request is rejected with a 400! 13) Make an API request: GET /api/v1/patrons?_per_page=50 14) Note the request succeeds! 15) Make an API request: GET /api/v1/patrons?_per_page=100 16) Note the request succeeds! Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.