Re: is there a way to prevent abusing rows parameter

2012-11-26 Thread Amit Nithian
If you're going to validate the rows parameter, may as well validate the start parameter too.. I've run into problems with start and rows with ridiculously high values crash our servers. On Thu, Nov 22, 2012 at 9:58 AM, solr-user wrote: > Thanks guys. This is a problem with the front end not v

Re: is there a way to prevent abusing rows parameter

2012-11-22 Thread solr-user
Thanks guys. This is a problem with the front end not validating requests. I was hoping there might be a simple config value I could enter/change, rather than going the long process of migrating a proper fix all the way up to our production servers. Looks like not, but thx. -- View this messa

Re: is there a way to prevent abusing rows parameter

2012-11-21 Thread Alexandre Rafalovitch
Does that 'someone' has direct access to Solr endpoint? Is that a right thing to do in a first place? But assuming they do (e.g. intranet), you could build on Jack's suggestion and create a couple of query-handler end-points that are only different in invariant raw count value. So, your default se

Re: is there a way to prevent abusing rows parameter

2012-11-20 Thread Jack Krupansky
You could set an "invariant" parameter value, but that would mean they can't give an override. It might be a useful addition to Solr to have a maximum value (specified as an invariant). You could also simply add your own Solr "search component" that checked and maxed the &rows. -- Jack Kru