Prevented one form of DoS attack by limiting number of tags in query to 6.

Don't show search form if there are already 6 tags chosen.

diff --git a/apps/catalogue/templatetags/catalogue_tags.py b/apps/catalogue/templatetags/catalogue_tags.py
index 537e3ec..90cbec3 100644 (file)
--- a/apps/catalogue/templatetags/catalogue_tags.py
+++ b/apps/catalogue/templatetags/catalogue_tags.py
@@ -132,7 +132,7 @@ def authentication_form():
 def breadcrumbs(tags, search_form=True):
     from catalogue.forms import SearchForm
     context = {'tag_list': tags}
-    if search_form:
+    if search_form and len(tags) < 6:
         context['search_form'] = SearchForm(tags=tags)
     return context
 

diff --git a/apps/catalogue/views.py b/apps/catalogue/views.py
index 0525374..d8a61e3 100644 (file)
--- a/apps/catalogue/views.py
+++ b/apps/catalogue/views.py
@@ -97,6 +97,10 @@ def book_list(request):
 
 
 def tagged_object_list(request, tags=''):
+    # Prevent DoS attacks on our database
+    if len(tags.split('/')) > 6:
+        raise Http404
+        
     try:
         tags = models.Tag.get_tag_list(tags)
     except models.Tag.DoesNotExist:

diff --git a/wolnelektury/media/css/master.css b/wolnelektury/media/css/master.css
index 860a2dd..82d55a8 100644 (file)
--- a/wolnelektury/media/css/master.css
+++ b/wolnelektury/media/css/master.css
@@ -132,7 +132,8 @@ em {
     margin: 0;
     padding: 0;
     list-style: none;
-    display: inline;
+    display: block;
+    float: left;
 }
 
 #search-form li.category, #search-form li.book-title {
@@ -144,6 +145,7 @@ em {
     -moz-border-radius: 3px;
     -webkit-border-radius: 3px;
     border-radius: 3px;
+    margin-right: 0.25em;
 }
 
 #search-form li.book-title {

diff --git a/wolnelektury/templates/catalogue/breadcrumbs.html b/wolnelektury/templates/catalogue/breadcrumbs.html
index 896d999..ecf8dba 100644 (file)
--- a/wolnelektury/templates/catalogue/breadcrumbs.html
+++ b/wolnelektury/templates/catalogue/breadcrumbs.html
@@ -4,6 +4,9 @@
         {% for tag in tag_list %}
         <li class="category"><a href="{% catalogue_url tag %}">{{ tag }}</a> | <a href="{% catalogue_url tag_list -tag %}">x</a></li>
         {% endfor %}
-        <li>{{ search_form.q }} {{ search_form.tags }} <input type="submit" value="Szukaj"/></li>
+        {% if search_form %}
+            <li>{{ search_form.q }} {{ search_form.tags }} <input type="submit" value="Szukaj"/></li>
+        {% endif %}
     </ol>
+    <div class="clearboth"></div>
 </form>
\ No newline at end of file