prevent ordering by comment path without post filter (#3717)

This commit is contained in:
phiresky 2023-07-25 18:46:00 +02:00 committed by GitHub
parent 13a866aeb0
commit 3b09d8c882
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -340,8 +340,11 @@ impl<'a> CommentQuery<'a> {
query = query.filter(nlevel(comment::path).le(depth_limit));
// only order if filtering by a post id. DOS potential otherwise and max_depth + !post_id isn't used anyways (afaik)
if self.post_id.is_some() {
// Always order by the parent path first
query = query.order_by(subpath(comment::path, 0, -1));
}
// TODO limit question. Limiting does not work for comment threads ATM, only max_depth
// For now, don't do any limiting for tree fetches