From 4fcb28e081658dec5dc91925086a624c6369b18a Mon Sep 17 00:00:00 2001 From: David Roetzel Date: Tue, 9 Jun 2026 12:31:58 +0200 Subject: [PATCH] Collections API: Set a maximum for the pagination `limit` param (#39342) --- app/controllers/api/v1/collections_controller.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/controllers/api/v1/collections_controller.rb b/app/controllers/api/v1/collections_controller.rb index 9acd535f46..50a825afac 100644 --- a/app/controllers/api/v1/collections_controller.rb +++ b/app/controllers/api/v1/collections_controller.rb @@ -4,6 +4,7 @@ class Api::V1::CollectionsController < Api::BaseController include Authorization DEFAULT_COLLECTIONS_LIMIT = 40 + MAX_COLLECTIONS_LIMIT = 100 rescue_from ActiveRecord::RecordInvalid, Mastodon::ValidationError do |e| render json: { error: ValidationErrorFormatter.new(e).as_json }, status: 422 @@ -73,7 +74,7 @@ class Api::V1::CollectionsController < Api::BaseController .with_tag .order(created_at: :desc) .offset(offset_param) - .limit(limit_param(DEFAULT_COLLECTIONS_LIMIT)) + .limit(limit_param(DEFAULT_COLLECTIONS_LIMIT, MAX_COLLECTIONS_LIMIT)) @collections = @collections.discoverable unless @account == current_account end