You are looking at the wrong code.

You should be looking at the code for the limitboxfield in libraries\src\Form\Field

You are looking at the wrong code.

You should be looking at the code for the limitboxfield in libraries\src\Form\Field

very nice, but how to override him and remove JALL?

Only one small additional knob in Global configuration, on Site tab, as "Allow show All" must solved this important issue.

Thanks for providing this suggestion. I never thought about that but if your admins use the "All" option on a really huge Data base, it can indeed be an issue. We keep this as a feature request.

Even on a site with 50,000 articles the ALL has a useful function as it applies to the filtered list as well as an unfiltered list

@chmst
Thanks for providing this suggestion. I never thought about that but if your admins use the "All" option on a really huge Data base, it can indeed be an issue. We keep this as a feature request.

this not only if admins use the "All" option, very dagerous when this option accesible on frontend for all users! this potential hole for DDOS attack on a site/server

more useful if Limit length element list will be more adjustable as min -> max value...[5, 10, 15, 20, 25, 30, 50, 100, 200, 500, 0]

impatiently we will be wait to the implementation

@itmagpro
I agree! Certain Joomla extensions have recognised this problem and let the request "ALL" run into the void. Not such a great way either.

But there is a very simple way to hide this with jQuery. Simply insert this code at the end of the body as a workaround. "id" and "option" must of course be adapted.
<script> $('select[id="limit"] option[value="0"]').remove(); </script>

(You've probably already figured it out.)

@Gratia-Mira
Nice! But, this just fake masquerade and not protect from direct requests...

Certain Joomla extensions have recognised this problem and let the request "ALL" run into the void.

Custom components can use attributes limits and/or remove and/or showall="false" in fields of type Limitbox to change the options.

But there is a very simple way to hide this with jQuery.

One can also override JLayout layouts\joomla\form\field\list.php by adding a condition like (at least in Joomla 5)

if ($name === 'list[limit]')
{
	foreach($options as $key => $option)
	{
		if ($option->value == 0)
		{
			unset($options[$key]);
		}
	}
}

I know, you'll find a more elegant way ;-)

But, this just fake masquerade and not protect from direct requests...

I don't think that there is a practicable way in Joomla core without changing many of files (mainly models and/or tables) to avoid these requests even if there is a global setting to hide JALL in limitboxes.

@ReLater

... I don't think that there is a practicable way in Joomla core without changing many of files (mainly models) to avoid these requests even if there is a global setting to hide JALL in limitboxes.

exactly, and this very bad! This is very important hole for site with big/huge DB!

P.S. DDOS welcom ... or some how to filter requests on OS layer and drop JALL (if isset this value in request)

UPD ...global setting MUST BY NOT hide JALL, but MUST BY FORBIDDEN (on joomla core layer) if this defined in global setting! This is posible! And not need changing many of files (mainly models), need change joomla core in this part (pagination etc)! Understand, ok? But who do this? I? But no have time (war and etc), and no donate no love no peace in this hostile world...

We found crutch-feature for fix this hole for all whole site, and also tested - rewrite _REQUEST in defines.php, enjoy guys :)

We found crutch-feature for fix this hole for all whole site, and also tested - rewrite _REQUEST in defines.php, enjoy guys :)

Great idea to use user provided content without filtering, don't do that!

If you really can wait make a system plugin and try to change it onAfterRoute something.

create a plugin with the following function

class DisableShowAll extends CMSPlugin implements SubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            'onContentPrepareForm'      => 'onContentPrepareForm',
        ];
            
    }
    public function onContentPrepareForm(PrepareFormEvent $event)
    {
        $form    = $event->getForm();

        $xml     = $form->getXml();
        $elements = $xml->xpath('//field[@type="limitbox"]');
        
        foreach($elements as $element) {
            $element->addAttribute('showall', 'false');
        }
    }
}

How to create plugins can be found at https://manual.joomla.org/docs/next/building-extensions/plugins/basic-content-plugin.

I added this issue to the next Wednesday maintainer meeting.

We found crutch-feature for fix this hole for all whole site, and also tested - rewrite _REQUEST in defines.php, enjoy guys :)

Great idea to use user provided content without filtering, don't do that!

If you really can wait make a system plugin and try to change it onAfterRoute something.

@rdeutz you understand what you talk? Explain to me, please, how we can "to use user provided content without filtering" when we only filtering (check) and set need value in $_REQUEST['list']['limit'] parameter? Explain to me, please, - or dont spam here about nothing!

HLeithner
DisableShowAll plugin...

Nice! But, this just fake masquerade and not protect from direct requests! @HLeithner - you not enoug understand this issue.

Originally posted by @itmagpro in #41380 (comment)

No need any plugins, [rewrite _REQUEST in defines.php] enoug elegance solution for fix this joomla bug! enjoy guys :)

Originally posted by @itmagpro in #41380 (comment)

wow - some automated translators are either really bad or realy rude

@itmagpro your tone is very rude, if you don't stop this insulting and start to communicate in a nice way with people trying to help you, will end in an temporary ban from this repo.

@itmagpro your tone is very rude, if you don't stop this insulting and start to communicate in a nice way with people trying to help you, will end in an temporary ban from this repo.

@HLeithner My tone is very nice and without empty words!

NO ONE BODY NOT HELPED ME HERE!!!

I HELPED BY ME SELF!

SO... - fuc.you all, spammers! Bye.

At least you are making it easy for us. I banned you until further notice.

beside that robert gave you the hint to implement your filter in a system plugin in the onafterroute event.
I explained you how to fix the form fields.

Anyway we will look on this again on Wednesday

We discussed this yesterday in the weekly maintainers meeting. We think a good first step would be to have a layout for this. If someone wants to make a PR, we are happy to look at it.