XFMG is missing pagination

[stromb0li]

Affected version

2.3.7

When calling /api/media-category/{id}/content all photos for that category load; none of it is paginated, even if passing the page parameter.

For categories/albums with hundreds or thousands of images, this can be abused as a way to attack the server, as it generates enormous responses on request. Currently with just under a thousand photos, I can spike memory utilization to ~100MB+ per request.

 

[stromb0li]

Fixes (it looks like ablum load is missing as well):
/src/addons/XFMG/Api/Category.php:104
Replace $finder->fetch() with $finder->limitByPage($page, $perPage)->fetch() (fix for loading albums)

/src/addons/XFMG/Api/Category.php:157
Replace $finder->fetch() with $finder->limitByPage($page, $perPage)->fetch() (fix for loading media)