diff --git a/server/handlers/auth/feed.go b/server/handlers/auth/feed.go index ae04aa1..59770a9 100644 --- a/server/handlers/auth/feed.go +++ b/server/handlers/auth/feed.go @@ -16,6 +16,12 @@ func GetFeed(c *fiber.Ctx) error { limit := c.QueryInt("limit", 10) offset := c.QueryInt("offset", 0) + if limit > 30 { + return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{ + "message": "Limit must be less than 30.", + }) + } + user, ok := c.Locals("user").(models.User) if !ok { return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{ diff --git a/server/handlers/posts/get_post_comments.go b/server/handlers/posts/get_post_comments.go index 8198a7f..69fe5ec 100644 --- a/server/handlers/posts/get_post_comments.go +++ b/server/handlers/posts/get_post_comments.go @@ -23,6 +23,12 @@ func GetPostComments(c *fiber.Ctx) error { limit := c.QueryInt("limit", 10) offset := c.QueryInt("offset", 0) + if limit > 30 { + return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{ + "message": "Limit must be less than 30.", + }) + } + comments, err := models.GetCommentsByPostID(postID, int64(limit), int64(offset)) if err != nil { return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{ diff --git a/server/handlers/posts/get_posts.go b/server/handlers/posts/get_posts.go index f01aa53..621a69c 100644 --- a/server/handlers/posts/get_posts.go +++ b/server/handlers/posts/get_posts.go @@ -16,6 +16,12 @@ func GetPosts(c *fiber.Ctx) error { limit := c.QueryInt("limit", 10) offset := c.QueryInt("offset", 0) + if limit > 30 { + return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{ + "message": "Limit must be less than 30.", + }) + } + posts, err := models.GetPosts(int64(limit), int64(offset), nil, bson.M{"created_at": -1}) if err != nil { return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{ diff --git a/server/handlers/users/follows.go b/server/handlers/users/follows.go index 09e66c6..64f808a 100644 --- a/server/handlers/users/follows.go +++ b/server/handlers/users/follows.go @@ -11,6 +11,12 @@ func Follows(c *fiber.Ctx) error { limit := c.QueryInt("limit", 10) offset := c.QueryInt("offset", 0) + if limit > 30 { + return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{ + "message": "Limit must be less than 30.", + }) + } + slug := c.Params("slug") user, err := models.GetUserByUsername(slug) if err != nil { diff --git a/server/handlers/users/get_user_posts.go b/server/handlers/users/get_user_posts.go index dfeec70..27cbfda 100644 --- a/server/handlers/users/get_user_posts.go +++ b/server/handlers/users/get_user_posts.go @@ -23,6 +23,12 @@ func GetUserPosts(c *fiber.Ctx) error { limit := c.QueryInt("limit", 10) offset := c.QueryInt("offset", 0) + if limit > 30 { + return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{ + "message": "Limit must be less than 30.", + }) + } + posts, err := models.GetPosts(int64(limit), int64(offset), bson.M{"author": user.ID}, bson.M{"created_at": -1}) if err != nil { return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{ diff --git a/server/handlers/users/get_users.go b/server/handlers/users/get_users.go index 0db7d62..f49e1f7 100644 --- a/server/handlers/users/get_users.go +++ b/server/handlers/users/get_users.go @@ -10,6 +10,12 @@ func GetUsers(c *fiber.Ctx) error { limit := c.QueryInt("limit", 10) offset := c.QueryInt("offset", 0) + if limit > 30 { + return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{ + "message": "Limit must be less than 30.", + }) + } + users, err := models.GetUsers(int64(limit), int64(offset), bson.M{}, bson.M{"points": -1}) if err != nil { return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{