From 6d0c07840c6eae4f854152da051c46b9320ea0dd Mon Sep 17 00:00:00 2001
From: Andrey Kleshchev <andreykproductengine@lindenlab.com>
Date: Thu, 20 Apr 2023 20:04:11 +0300
Subject: SL-19533 Cap folder request depth

---
 indra/newview/llaisapi.cpp | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

(limited to 'indra/newview')

diff --git a/indra/newview/llaisapi.cpp b/indra/newview/llaisapi.cpp
index 7a87fc6c3d..d39bb57304 100644
--- a/indra/newview/llaisapi.cpp
+++ b/indra/newview/llaisapi.cpp
@@ -456,13 +456,17 @@ void AISAPI::FetchCategoryChildren(const LLUUID &catId, ITEM_TYPE type, bool rec
 
     if (recursive)
     {
-        url += "?depth=*";
+        // can specify depth=*, but server side is going to cap requests
+        // and reject everything 'over the top',.
+        depth = 50;
     }
     else
     {
-        url += "?depth=" + std::to_string(depth);
+        depth = llmax(depth, 50);
     }
 
+    url += "?depth=" + std::to_string(depth);
+
     invokationFn_t getFn = boost::bind(
         // Humans ignore next line.  It is just a cast to specify which LLCoreHttpUtil::HttpCoroutineAdapter routine overload.
         static_cast<LLSD(LLCoreHttpUtil::HttpCoroutineAdapter::*)(LLCore::HttpRequest::ptr_t, const std::string &, LLCore::HttpOptions::ptr_t, LLCore::HttpHeaders::ptr_t)>
@@ -477,7 +481,7 @@ void AISAPI::FetchCategoryChildren(const LLUUID &catId, ITEM_TYPE type, bool rec
 
     // get doesn't use body, can pass additional data
     LLSD body;
-    body["depth"] = recursive ? S32_MAX : depth;
+    body["depth"] = depth;
     LLCoprocedureManager::CoProcedure_t proc(boost::bind(&AISAPI::InvokeAISCommandCoro,
         _1, getFn, url, catId, body, callback, FETCHCATEGORYCHILDREN));
 
@@ -505,13 +509,17 @@ void AISAPI::FetchCategoryChildren(const std::string &identifier, bool recursive
 
     if (recursive)
     {
-        url += "?depth=*";
+        // can specify depth=*, but server side is going to cap requests
+        // and reject everything 'over the top',.
+        depth = 50;
     }
     else
     {
-        url += "?depth=" + std::to_string(depth);
+        depth = llmax(depth, 50);
     }
 
+    url += "?depth=" + std::to_string(depth);
+
     invokationFn_t getFn = boost::bind(
         // Humans ignore next line.  It is just a cast to specify which LLCoreHttpUtil::HttpCoroutineAdapter routine overload.
         static_cast<LLSD(LLCoreHttpUtil::HttpCoroutineAdapter::*)(LLCore::HttpRequest::ptr_t, const std::string &, LLCore::HttpOptions::ptr_t, LLCore::HttpHeaders::ptr_t)>
@@ -526,7 +534,7 @@ void AISAPI::FetchCategoryChildren(const std::string &identifier, bool recursive
 
     // get doesn't use body, can pass additional data
     LLSD body;
-    body["depth"] = recursive ? S32_MAX : depth;
+    body["depth"] = depth;
     LLCoprocedureManager::CoProcedure_t proc(boost::bind(&AISAPI::InvokeAISCommandCoro,
         _1, getFn, url, LLUUID::null, body, callback, FETCHCATEGORYCHILDREN));
 
@@ -552,13 +560,17 @@ void AISAPI::FetchCategoryCategories(const LLUUID &catId, ITEM_TYPE type, bool r
 
     if (recursive)
     {
-        url += "?depth=*";
+        // can specify depth=*, but server side is going to cap requests
+        // and reject everything 'over the top',.
+        depth = 50;
     }
     else
     {
-        url += "?depth=" + std::to_string(depth);
+        depth = llmax(depth, 50);
     }
 
+    url += "?depth=" + std::to_string(depth);
+
     invokationFn_t getFn = boost::bind(
         // Humans ignore next line.  It is just a cast to specify which LLCoreHttpUtil::HttpCoroutineAdapter routine overload.
         static_cast<LLSD(LLCoreHttpUtil::HttpCoroutineAdapter::*)(LLCore::HttpRequest::ptr_t, const std::string &, LLCore::HttpOptions::ptr_t, LLCore::HttpHeaders::ptr_t)>
-- 
cgit v1.2.3