Skip to content

Commit

Permalink
Limit number of included scripts in get_scripts.js.php
Browse files Browse the repository at this point in the history
This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
  • Loading branch information
nijel committed Jun 15, 2016
1 parent 5633b1d commit 4767f24
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion js/get_scripts.js.php
Expand Up @@ -36,7 +36,8 @@ function () {

$_GET['scripts'] = json_decode($_GET['scripts']);
if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
foreach ($_GET['scripts'] as $script) {
// Only up to 10 scripts as this is what we generate
foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
// Sanitise filename
$script_name = 'js';

Expand Down

0 comments on commit 4767f24

Please sign in to comment.