Merge pull request from GHSA-2m59-c483-c8qj

Disallow submitting more than four flights in a single request
jpatokal · Feb 1, 2024 · 74539bd · 74539bd
2 parents 2d76df9 + 91f8893
commit 74539bd
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/openflights.js b/openflights.js
@@ -3867,6 +3867,7 @@ function selectAirport(apid, select, quick, code) {
 function changeRows(type) {
   switch (type) {
     case "More":
+      // NOTE: also change the limit in submit.php to support more flights in a single request
       if (multiinput_rows >= 3) {
         $("b_more").disabled = true;
       }

diff --git a/php/submit.php b/php/submit.php
@@ -23,7 +23,7 @@
 $mode = $_POST["mode"];
 $note = stripslashes($_POST["note"]);
 $param = $_POST["param"];
-$multi = $_POST["multi"] ?? false;
+$multi = intval($_POST["multi"]);
 
 if (!$mode || $mode == "") {
     $mode = "F";
@@ -83,8 +83,8 @@
 $num_added = 0;
 switch ($param) {
     case "ADD":
-        // Can add multiple flights or just one
-        if ($multi) {
+        // Can add multiple (at most 4) flights or just one
+        if ($multi >= 1 && $multi <= 4) {
             for ($idx = 0; $idx < $multi; $idx++) {
                 $rows[$idx] = $idx + 1;
             }