Merge branch 'max_paginate_by' of git://github.com/alexander-akhmetov/django-rest-framework into alexander-akhmetov-max_paginate_by

3 files changed, 58 insertions, 2 deletions

diff --git a/rest_framework/generics.py b/rest_framework/generics.py
index 5ecf6310..ce6c462a 100644
--- a/rest_framework/generics.py
+++ b/rest_framework/generics.py
@@ -56,6 +56,7 @@ class GenericAPIView(views.APIView):
     # Pagination settings
     paginate_by = api_settings.PAGINATE_BY
     paginate_by_param = api_settings.PAGINATE_BY_PARAM
+    max_paginate_by = api_settings.MAX_PAGINATE_BY
     pagination_serializer_class = api_settings.DEFAULT_PAGINATION_SERIALIZER_CLASS
     page_kwarg = 'page'
 
@@ -207,11 +208,19 @@ class GenericAPIView(views.APIView):
         if self.paginate_by_param:
             query_params = self.request.QUERY_PARAMS
             try:
-                return int(query_params[self.paginate_by_param])
+                paginate_by_param = int(query_params[self.paginate_by_param])
             except (KeyError, ValueError):
                 pass
+            else:
+                if self.max_paginate_by is not None:
+                    return min(self.max_paginate_by, paginate_by_param)
+                else:
+                    return paginate_by_param
 
-        return self.paginate_by
+        if self.max_paginate_by:
+            return min(self.max_paginate_by, self.paginate_by)
+        else:
+            return self.paginate_by
 
     def get_serializer_class(self):
         """
diff --git a/rest_framework/settings.py b/rest_framework/settings.py
index 2ee15ac7..8c084751 100644
--- a/rest_framework/settings.py
+++ b/rest_framework/settings.py
@@ -67,6 +67,7 @@ DEFAULTS = {
     # Pagination
     'PAGINATE_BY': None,
     'PAGINATE_BY_PARAM': None,
+    'MAX_PAGINATE_BY': None,
 
     # Authentication
     'UNAUTHENTICATED_USER': 'django.contrib.auth.models.AnonymousUser',
diff --git a/rest_framework/tests/test_pagination.py b/rest_framework/tests/test_pagination.py
index 85d4640e..cbed1604 100644
--- a/rest_framework/tests/test_pagination.py
+++ b/rest_framework/tests/test_pagination.py
@@ -42,6 +42,16 @@ class PaginateByParamView(generics.ListAPIView):
     paginate_by_param = 'page_size'
 
 
+class MaxPaginateByView(generics.ListAPIView):
+    """
+    View for testing custom max_paginate_by usage
+    """
+    model = BasicModel
+    paginate_by = 5
+    max_paginate_by = 3
+    paginate_by_param = 'page_size'
+
+
 class IntegrationTestPagination(TestCase):
     """
     Integration tests for paginated list views.
@@ -313,6 +323,42 @@ class TestCustomPaginateByParam(TestCase):
         self.assertEqual(response.data['results'], self.data[:5])
 
 
+class TestMaxPaginateByParam(TestCase):
+    """
+    Tests for list views with max_paginate_by kwarg
+    """
+
+    def setUp(self):
+        """
+        Create 13 BasicModel instances.
+        """
+        for i in range(13):
+            BasicModel(text=i).save()
+        self.objects = BasicModel.objects
+        self.data = [
+            {'id': obj.id, 'text': obj.text}
+            for obj in self.objects.all()
+        ]
+        self.view = MaxPaginateByView.as_view()
+
+    def test_max_paginate_by(self):
+        """
+        If max_paginate_by is set and it less than paginate_by, new kwarg should limit requests for review.
+        """
+        request = factory.get('/?page_size=10')
+        response = self.view(request).render()
+        self.assertEqual(response.data['count'], 13)
+        self.assertEqual(response.data['results'], self.data[:3])
+
+    def test_max_paginate_by_without_page_size_param(self):
+        """
+        If max_paginate_by is set, new kwarg should limit requests for review.
+        """
+        request = factory.get('/')
+        response = self.view(request).render()
+        self.assertEqual(response.data['results'], self.data[:3])
+
+
 ### Tests for context in pagination serializers
 
 class CustomField(serializers.Field):