Skip to content

Commit abb3685

Browse files
committed
Limit number of included scripts in get_scripts.js.php
This avoids potential DOS, the limit is same as we use for generating the URLs. Signed-off-by: Michal Čihař <michal@cihar.com>
1 parent 1dca386 commit abb3685

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

js/get_scripts.js.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@
3535

3636
$_GET['scripts'] = json_decode($_GET['scripts']);
3737
if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
38-
foreach ($_GET['scripts'] as $script) {
38+
// Only up to 10 scripts as this is what we generate
39+
foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
3940
// Sanitise filename
4041
$script_name = 'js';
4142

0 commit comments

Comments
 (0)