返回提交历史
Modified
src/controllers/custom/pushArchonCrystalUpgradeController.ts
+6
-4
Modified
static/webui/index.html
+1
-1
XFEstudio/SpaceNinjaServer
fix: possible denial of service via a single (authenticated) request (#442)
543d94e8
代码差异
2 个文件
+7
-5
@@ -10,11 +10,13 @@ export const pushArchonCrystalUpgradeController: RequestHandler = async (req, re
10
10
if (suit) {
11
11
suit.ArchonCrystalUpgrades ??= [];
12
12
const count = (req.query.count as number | undefined) ?? 1;
13
for (let i = 0; i != count; ++i) {
14
suit.ArchonCrystalUpgrades.push({ UpgradeType: req.query.type as string });
13
if (count >= 1 && count <= 10000) {
14
for (let i = 0; i != count; ++i) {
15
suit.ArchonCrystalUpgrades.push({ UpgradeType: req.query.type as string });
16
}
17
await inventory.save();
18
res.end();
15
19
}
16
await inventory.save();
17
res.end();
18
20
}
19
21
res.status(400).end();
20
22
};
@@ -114,7 +114,7 @@
114
114
<div class="card-body">
115
115
<p>You can use these unlimited slots to apply a wide range of upgrades.</p>
116
116
<form class="input-group mb-3" onsubmit="doPushArchonCrystalUpgrade();return false;">
117
<input type="number" id="archon-crystal-add-count" min="1" value="1" class="form-control" style="max-width:100px" />
117
<input type="number" id="archon-crystal-add-count" min="1" max="10000" value="1" class="form-control" style="max-width:100px" />
118
118
<span class="input-group-text">x</span>
119
119
<input class="form-control" list="datalist-archonCrystalUpgrades" />
120
120
<button class="btn btn-primary" type="submit">Add</button>