5 files changed, 37 insertions, 0 deletions

diff --git a/app/config/config.yml b/app/config/config.yml
index 4f4fb900..451809d6 100644
--- a/app/config/config.yml
+++ b/app/config/config.yml
@@ -55,6 +55,7 @@ wallabag_core:
     list_mode: 0
     fetching_error_message: |
         wallabag can't retrieve contents for this article. Please <a href="http://doc.wallabag.org/en/master/user/errors_during_fetching.html#how-can-i-help-to-fix-that">troubleshoot this issue</a>.
+    api_limit_mass_actions: 10
 
 wallabag_user:
     registration_enabled: "%fosuser_registration%"
diff --git a/src/Wallabag/ApiBundle/Controller/EntryRestController.php b/src/Wallabag/ApiBundle/Controller/EntryRestController.php
index ae6f0e3f..7c3e778e 100644
--- a/src/Wallabag/ApiBundle/Controller/EntryRestController.php
+++ b/src/Wallabag/ApiBundle/Controller/EntryRestController.php
@@ -5,6 +5,7 @@ namespace Wallabag\ApiBundle\Controller;
 use Hateoas\Configuration\Route;
 use Hateoas\Representation\Factory\PagerfantaFactory;
 use Nelmio\ApiDocBundle\Annotation\ApiDoc;
+use Symfony\Component\Config\Definition\Exception\Exception;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
@@ -229,6 +230,8 @@ class EntryRestController extends WallabagRestController
      * )
      *
      * @return JsonResponse
+     *
+     * @throws Symfony\Component\Config\Definition\Exception\Exception When limit is reached
      */
     public function postEntriesListAction(Request $request)
     {
@@ -237,6 +240,12 @@ class EntryRestController extends WallabagRestController
         $urls = json_decode($request->query->get('urls', []));
         $results = [];
 
+        $limit = $this->container->getParameter('wallabag_core.api_limit_mass_actions');
+
+        if (count($urls) > $limit) {
+            throw new Exception('API limit reached');
+        }
+
         // handle multiple urls
         if (!empty($urls)) {
             foreach ($urls as $key => $url) {
diff --git a/src/Wallabag/CoreBundle/DependencyInjection/Configuration.php b/src/Wallabag/CoreBundle/DependencyInjection/Configuration.php
index 006a18c3..75b37729 100644
--- a/src/Wallabag/CoreBundle/DependencyInjection/Configuration.php
+++ b/src/Wallabag/CoreBundle/DependencyInjection/Configuration.php
@@ -47,6 +47,9 @@ class Configuration implements ConfigurationInterface
                 ->scalarNode('list_mode')
                     ->defaultValue(1)
                 ->end()
+                ->scalarNode('api_limit_mass_actions')
+                    ->defaultValue(10)
+                ->end()
             ->end()
         ;
 
diff --git a/src/Wallabag/CoreBundle/DependencyInjection/WallabagCoreExtension.php b/src/Wallabag/CoreBundle/DependencyInjection/WallabagCoreExtension.php
index aa9ee339..c075c19f 100644
--- a/src/Wallabag/CoreBundle/DependencyInjection/WallabagCoreExtension.php
+++ b/src/Wallabag/CoreBundle/DependencyInjection/WallabagCoreExtension.php
@@ -26,6 +26,7 @@ class WallabagCoreExtension extends Extension
         $container->setParameter('wallabag_core.action_mark_as_read', $config['action_mark_as_read']);
         $container->setParameter('wallabag_core.list_mode', $config['list_mode']);
         $container->setParameter('wallabag_core.fetching_error_message', $config['fetching_error_message']);
+        $container->setParameter('wallabag_core.api_limit_mass_actions', $config['api_limit_mass_actions']);
 
         $loader = new Loader\YamlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
         $loader->load('services.yml');
diff --git a/tests/Wallabag/ApiBundle/Controller/EntryRestControllerTest.php b/tests/Wallabag/ApiBundle/Controller/EntryRestControllerTest.php
index 88a5be93..8594ad0b 100644
--- a/tests/Wallabag/ApiBundle/Controller/EntryRestControllerTest.php
+++ b/tests/Wallabag/ApiBundle/Controller/EntryRestControllerTest.php
@@ -809,4 +809,27 @@ class EntryRestControllerTest extends WallabagApiTestCase
         $this->assertFalse($content[1]['entry']);
         $this->assertEquals('http://0.0.0.0/entry3', $content[1]['url']);
     }
+
+    /**
+     * @expectedException Symfony\Component\Config\Definition\Exception\Exception
+     * @expectedExceptionMessage API limit reached
+     */
+    public function testLimitBulkAction()
+    {
+        $list = [
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+            'http://0.0.0.0/entry1',
+        ];
+
+        $this->client->request('POST', '/api/entries/lists?urls='.json_encode($list));
+    }
 }