When looking at the instances of blocks in either M1.9 or M2.x via the "Manage Blocks" screen you cannot get past the first page of results.

There is a potential security issue according to one our developer's reports. The page that displays the list of instances of blocks doesn't seem to check if the user is logged in before doing a huge query for the block instances. Report is as follows:

—
I'm able to view that page without logging in. It seems like a security flaw since i'm not authorized and I can view the content, or refresh the page over and over putting a heavy load on the server while it tries to fetch 6,500 block records. I think I'm able to do this because the sesskey is in the URL.

https://<URL>/course/search.php?search=&perpage=99999&blocklist=7&sesskey=qLwJ2tcQYm

is the correct URL for showing all.
—
Steps to reproduce
M1.9:

1. On Site Admin panel go to Modules > Manage Blocks
2. Click on link in "Instances" column > on blocks with any instances (about 40+) there are links called Show all or Next.
3. Click on either the "Show all" or "Next"
4. Blank page with a search box

M2.x:

1. On Site Admin panel go to Plugins > Blocks > Manage Blocks
2. Click on link in "Instances" column > on blocks with any instances (about 40+) there are links called Show all or Next.
3. Click on either the "Show all" or "Next"
4. Blank page with a search box