main ← fix/data-explorer-limit-security
merged 06:43AM - 06 Mar 26 UTC
Non-admin users with group-level query access could pass `limit=ALL` or an arbit…rarily large integer to bypass the row limit cap on data explorer queries.
This commit removes support for the `ALL` value for the `limit` query param since it is unbounded.
We consider this a security hardening fix instead of a security flaw since there are many conditions for this code path to be exploited and those conditions are quite rare.