github-mirror/project-nomad
1
0
Fork 0
mirror of https://github.com/Crosstalk-Solutions/project-nomad.git synced 2026-10-17 05:14:19 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fix(maps): cap marker notes at 500 characters server-side

Browse Source 
The UI enforces 500 characters but the validator did not, so the API accepted
up to the MySQL TEXT ceiling. The API needs no authentication by design, so an
uncapped free-text column reachable from any page a user visits is a cheap way
to bloat the database. Matches the limit the form already shows.

Found in a security review of the release PRs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8Mgg1vd2eKSs8StZiuyMV
This commit is contained in:
Chris Sherwood 2026-08-30 21:12:07 -07:00 committed by Jake Turner
parent 821f952c18
commit 78017a333d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
admin/app/controllers/maps_controller.ts
View File

@ -190,7 +190,7 @@ export default class MapsController {
icon: vine.string().trim().maxLength(50).nullable().optional(),
icon_color: vine.string().trim().maxLength(7).nullable().optional(),
visible: vine.boolean().optional(),
notes: vine.string().trim().nullable().optional(),
notes: vine.string().trim().maxLength(500).nullable().optional(),
marker_type: vine.string().trim().maxLength(20).optional(),
})
)
@ -231,7 +231,7 @@ export default class MapsController {
visible: vine.boolean().optional(),
longitude: vine.number().min(-180).max(180).optional(),
latitude: vine.number().min(-90).max(90).optional(),
notes: vine.string().trim().nullable().optional(),
notes: vine.string().trim().maxLength(500).nullable().optional(),
marker_type: vine.string().trim().maxLength(20).optional(),
})
)