fix(Jobs): anchor throttle field regex to prevent id extraction bugs

Throttle POST field parsing used preg_replace with an unanchored
lazy pattern to pull numeric ids out of field names, which could
mis-extract or silently fall through on unexpected key formats.

- Replace preg_replace('/.*?_(\d+)$/', ...) with preg_match against
  an anchored pattern ('/^throttle_count_(\d+)$/' and
  '/^throttle_period_(\d+)$/') in app/Controllers/Jobs.php
- Only process the key when the anchored pattern actually matches,
  avoiding bogus $throttleId values feeding $arraySave/$notToDelete

Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
This commit is contained in:
objecttothis committed 2026-09-17 16:20:26 +04:00
1 parent b40d1bb82b
commit 9f70efb592
1 file changed
+4 -4
+4 -4
View File
@@ -88,12 +88,12 @@ class Jobs extends Secure_Controller
$arraySave = [];
foreach ($this->request->getPost() as $key => $value) {
if (str_starts_with($key, 'throttle_count_')) {
$throttleId = preg_replace('/.*?_(\d+)$/', '$1', $key);
if (str_starts_with($key, 'throttle_count_') && preg_match('/^throttle_count_(\d+)$/', $key, $matches)) {
$throttleId = $matches[1];
$notToDelete[] = $throttleId;
$arraySave[$throttleId]['max_count'] = $value;
} elseif (str_starts_with($key, 'throttle_period_')) {
$throttleId = preg_replace('/.*?_(\d+)$/', '$1', $key);
} elseif (str_starts_with($key, 'throttle_period_') && preg_match('/^throttle_period_(\d+)$/', $key, $matches)) {
$throttleId = $matches[1];
$arraySave[$throttleId]['period'] = $value;
}
}