mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-11-01 03:26:18 +00:00
78b320cbbc
`GET /api/convos` read its page size as `parseInt(req.query.limit, 10) || 25` and handed it to `getConvosByCursor` unclamped, where it becomes `.limit(limit + 1)`. `?limit=-1` therefore issued `.limit(0)`, which MongoDB reads as no limit at all, and the route returned the caller's entire conversation list in one response; `?limit=999999999` forced the same unbounded fetch. `attachSharedFlags` then amplified it with a second query whose `$in` carried every returned id. Every other list route already clamps, so the fix reuses that shape: the projects handler's local `normalizeLimit` moves to `packages/api/src/utils/query` and both routes share it, and `getConvosByCursor` bounds its own page size so the invariant holds for any caller. |
||
|---|---|---|
| .. | ||
| __test-utils__ | ||
| __tests__ | ||
| admin | ||
| agents | ||
| assistants | ||
| files | ||
| types | ||
| accessPermissions.js | ||
| accessPermissions.sharePolicy.test.js | ||
| accessPermissions.test.js | ||
| actions.js | ||
| apiKeys.js | ||
| auth.2fa-ratelimit.test.js | ||
| auth.cloudfront.test.js | ||
| auth.js | ||
| auth.reset-password-ratelimit.test.js | ||
| balance.js | ||
| banner.js | ||
| categories.js | ||
| code-environments.js | ||
| code-environments.test.js | ||
| config.js | ||
| convos.js | ||
| endpoints.js | ||
| index.js | ||
| insights.js | ||
| keys.js | ||
| mcp.js | ||
| memories.js | ||
| memories.test.js | ||
| messages.js | ||
| models.js | ||
| oauth.js | ||
| oauth.test.js | ||
| presets.js | ||
| presets.test.js | ||
| projects.js | ||
| prompts.js | ||
| prompts.test.js | ||
| roles.js | ||
| rum.js | ||
| schedules.js | ||
| search.js | ||
| settings.js | ||
| share.js | ||
| skills.js | ||
| skills.tenant.test.js | ||
| skills.test.js | ||
| static.js | ||
| tags.js | ||
| user.js | ||
| user.verify-ratelimit.test.js | ||