diff options
author | Joas Schilling <coding@schilljs.com> | 2022-05-12 10:55:41 +0200 |
---|---|---|
committer | Joas Schilling <coding@schilljs.com> | 2022-06-13 12:52:58 +0200 |
commit | 171f37d403f89057ebe85115fccc1303590b040d (patch) | |
tree | fc3e9366406ee811d8d04e40028f6a701e0eafc6 /lib/Controller/PollController.php | |
parent | 31c4d20dde2724474e649ca1c66ab8e03b55837b (diff) |
Check voting options for validity
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'lib/Controller/PollController.php')
-rw-r--r-- | lib/Controller/PollController.php | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/lib/Controller/PollController.php b/lib/Controller/PollController.php index 22cc14ea0..ade2a22e8 100644 --- a/lib/Controller/PollController.php +++ b/lib/Controller/PollController.php @@ -89,10 +89,10 @@ class PollController extends AEnvironmentAwareController { $message = json_encode([ 'message' => 'object_shared', 'parameters' => [ - 'objectType' => 'highlight', // FIXME 'talk-poll', + 'objectType' => 'talk-poll', 'objectId' => $poll->getId(), 'metaData' => [ - 'type' => 'highlight', // FIXME 'talk-poll', + 'type' => 'talk-poll', 'id' => $poll->getId(), 'name' => $question, ] @@ -105,7 +105,7 @@ class PollController extends AEnvironmentAwareController { $this->logger->error($e->getMessage(), ['exception' => $e]); } - return new DataResponse($this->renderPoll($poll, [])); + return new DataResponse($this->renderPoll($poll, []), Http::STATUS_CREATED); } /** @@ -144,6 +144,18 @@ class PollController extends AEnvironmentAwareController { return new DataResponse([], Http::STATUS_NOT_FOUND); } + if ($poll->getMaxVotes() !== Poll::MAX_VOTES_UNLIMITED + && $poll->getMaxVotes() < count($optionIds)) { + return new DataResponse([], Http::STATUS_BAD_REQUEST); + } + + $maxOptionId = max(array_keys(json_decode($poll->getOptions(), true, 512, JSON_THROW_ON_ERROR))); + $maxVotedId = max($optionIds); + $minVotedId = min($optionIds); + if ($minVotedId < 0 || $maxVotedId > $maxOptionId) { + return new DataResponse([], Http::STATUS_BAD_REQUEST); + } + $votes = $this->pollService->votePoll($this->participant, $poll, $optionIds); return new DataResponse($this->renderPoll($poll, $votes)); |