max_display_length and length param ignored if greater than 10

[Graeme Pietersz]

limit = min(int(self.request.REQUEST.get('length', 10)), self.max_display_length)

Which means there is no way to load more than 10 items into a table.

I think it would be more useful to have

int(self.request.REQUEST.get('length', self.max_display_length))

[Maciej Wisniowski]

I think you've missed something. Have a look:

>>> max_display_length = 100
>>> REQUEST = {}
>>> print( min(int(REQUEST.get('length', 10)), max_display_length))
10
>>> REQUEST = {'length': 50}
>>> print( min(int(REQUEST.get('length', 10)), max_display_length))
50

[Graeme Pietersz]

Yes, it works in the second example, but in the first max_display_length is just ignored.

So you can load more than 10 by using the request parameter, but not by changing max_display_length in a subclass - so you if override max_display_length to be more than it does not work.

[Maciej Wisniowski]

max_display_length, as it name suggests, is an upper limit to the number of the records to be returned. It is not a default value and it is not ignored - as it is used by min(...). If you have a huge table with big number of records, then if some nasty attacker sends a request(s) with a length=99999999 then it would be possible to block your server.

Number of records to be returned is determined by the 'length' parameter taken from the request - this is a parameter sent by DataTables (https://datatables.net/manual/server-side) which means changing the page size on the client side (datatables javascript) is a way to load more items into a table.