discogs: Skip Discogs query on insufficiently tagged files

beetsplug/discogs.py

@@ -157,6 +157,11 @@ def candidates(self, items, artist, album, va_likely, extra_tags=None):
         if not self.discogs_client:
             return
 
+        if not album and not artist:
+            self._log.debug('Skipping Discogs query. Files missing album and '
+                            'artist tags.')
+            return []
+
         if va_likely:
             query = album
         else:

docs/changelog.rst

@@ -22,7 +22,7 @@ Bug fixes:
 * :doc:`/plugins/unimported`: The new ``ignore_subdirectories`` configuration
   option added in 1.6.0 now has a default value if it hasn't been set.
 * :doc:`/plugins/deezer`: Tolerate missing fields when searching for singleton
-  tracks
+  tracks.
   :bug:`4116`
 * :doc:`/plugins/replaygain`: The type of the internal ``r128_track_gain`` and
   ``r128_album_gain`` fields was changed from integer to float to fix loss of
@@ -35,6 +35,9 @@ Bug fixes:
 * :doc:`plugins/web`: Fix handling of "query" requests. Previously queries
   consisting of more than one token (separated by a slash) always returned an
   empty result.
+* :doc:`/plugins/discogs`: Skip Discogs query on insufficiently tagged files
+  (artist and album tags missing) to prevent arbitrary candidate results.
+  :bug:`4227`
 
 For packagers:
 

docs/plugins/discogs.rst

@@ -19,7 +19,8 @@ authentication credentials via a personal access token or an OAuth2
 authorization.
 
 Matches from Discogs will now show up during import alongside matches from
-MusicBrainz.
+MusicBrainz. The search terms sent to the Discogs API are based on the artist
+and album tags of your tracks. If those are empty no query will be issued.
 
 If you have a Discogs ID for an album you want to tag, you can also enter it
 at the "enter Id" prompt in the importer.