AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-05 23:27:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Credential length guard

Browse Source
This commit is contained in:
johnnyq
2026-08-02 16:30:14 -04:00
parent e793804203
commit ad15fabbb3
5 changed files with 116 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
api/v1/credentials/credential_model.php
View File

@@ -3,6 +3,29 @@
// Variable assignment from POST (or: blank/from DB is updating)
/*
* There is no form behind the API, so nothing has capped these before they arrive.
* An overlong value is a hard MySQL error, not a truncation, so it would surface as a
* generic "insert query failed" - say what actually went wrong instead.
* Only the fields present are checked, which keeps partial updates working.
*/
$credential_field_too_long = checkCredentialLengths([
'name' => $_POST['credential_name'] ?? null,
'description' => $_POST['credential_description'] ?? null,
'uri' => $_POST['credential_uri'] ?? null,
'uri_2' => $_POST['credential_uri_2'] ?? null,
'username' => $_POST['credential_username'] ?? null,
'password' => $_POST['credential_password'] ?? null,
'otp_secret' => $_POST['credential_otp_secret'] ?? null,
]);
if ($credential_field_too_long) {
$return_arr['success'] = "False";
$return_arr['message'] = "credential_$credential_field_too_long is too long to store.";
echo json_encode($return_arr);
exit();
}
$api_key_decrypt_password = '';
if (isset($_POST['api_key_decrypt_password'])) {
$api_key_decrypt_password = $_POST['api_key_decrypt_password']; // No sanitization