Impose maximum character/line limits on playlist (server-side)

syncplay/constants.py

@@ -52,6 +52,8 @@ WARNING_OSD_MESSAGES_LOOP_INTERVAL = 1
 AUTOPLAY_DELAY = 3.0
 DO_NOT_RESET_POSITION_THRESHOLD = 1.0
 SYNC_ON_PAUSE = True  # Client seek to global position - subtitles may disappear on some media players
+PLAYLIST_MAX_CHARACTERS = 10000
+PLAYLIST_MAX_ITEMS = 250
 
 # Options for the File Switch feature:
 FOLDER_SEARCH_FIRST_FILE_TIMEOUT = 15.0 # Secs - How long to wait to find the first file in folder search (to take account of HDD spin up)

syncplay/server.py

@@ -11,7 +11,7 @@ import codecs
 import os
 from string import Template
 import argparse
-from syncplay.utils import RoomPasswordProvider, NotControlledRoom, RandomStringGenerator, meetsMinVersion
+from syncplay.utils import RoomPasswordProvider, NotControlledRoom, RandomStringGenerator, meetsMinVersion, playlistIsValid
 
 class SyncFactory(Factory):
     def __init__(self, password='', motdFilePath=None, isolateRooms=False, salt=None, disableReady=False):
@@ -139,14 +139,13 @@ class SyncFactory(Factory):
 
     def setPlaylist(self, watcher, files):
         room = watcher.getRoom()
-        if room.canControl(watcher):
+        if room.canControl(watcher) and playlistIsValid(files):
             watcher.getRoom().setPlaylist(files, watcher)
             self._roomManager.broadcastRoom(watcher, lambda w: w.setPlaylist(watcher.getName(), files))
         else:
             watcher.setPlaylist(room.getName(), room.getPlaylist())
             watcher.setPlaylistIndex(room.getName(), room.getPlaylistIndex())
 
-
     def setPlaylistIndex(self, watcher, index):
         room = watcher.getRoom()
         if room.canControl(watcher):
@@ -350,7 +349,7 @@ class ControlledRoom(Room):
             Room.setPosition(self, position, setBy)
 
     def setPlaylist(self, files, setBy=None):
-        if self.canControl(setBy):
+        if self.canControl(setBy) and playlistIsValid(files):
             self._playlist = files
 
     def setPlaylistIndex(self, index, setBy=None):

syncplay/utils.py

@@ -250,6 +250,13 @@ def getListAsMultilineString(pathArray):
 def convertMultilineStringToList(multilineString):
     return unicode.split(multilineString,u"\n") if multilineString else ""
 
+def playlistIsValid(files):
+    if len(files) > constants.PLAYLIST_MAX_ITEMS:
+        return False
+    elif sum(map(len, files)) > constants.PLAYLIST_MAX_CHARACTERS:
+        return False
+    return True
+
 def getDomainFromURL(URL):
     try:
         URL = URL.split("//")[-1].split("/")[0]