From 9f70efb5926bc84063663f26fe008fec109e55f8 Mon Sep 17 00:00:00 2001
From: objecttothis <17935339+objecttothis@users.noreply.github.com>
Date: Thu, 17 Sep 2026 16:20:26 +0400
Subject: [PATCH] fix(Jobs): anchor throttle field regex to prevent id
 extraction bugs

Throttle POST field parsing used preg_replace with an unanchored
lazy pattern to pull numeric ids out of field names, which could
mis-extract or silently fall through on unexpected key formats.

- Replace preg_replace('/.*?_(\d+)$/', ...) with preg_match against
  an anchored pattern ('/^throttle_count_(\d+)$/' and
  '/^throttle_period_(\d+)$/') in app/Controllers/Jobs.php
- Only process the key when the anchored pattern actually matches,
  avoiding bogus $throttleId values feeding $arraySave/$notToDelete

Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
---
 app/Controllers/Jobs.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/Controllers/Jobs.php b/app/Controllers/Jobs.php
index ae185a342..d5d15ab7a 100644
--- a/app/Controllers/Jobs.php
+++ b/app/Controllers/Jobs.php
@@ -88,12 +88,12 @@ class Jobs extends Secure_Controller
         $arraySave = [];
 
         foreach ($this->request->getPost() as $key => $value) {
-            if (str_starts_with($key, 'throttle_count_')) {
-                $throttleId = preg_replace('/.*?_(\d+)$/', '$1', $key);
+            if (str_starts_with($key, 'throttle_count_') && preg_match('/^throttle_count_(\d+)$/', $key, $matches)) {
+                $throttleId = $matches[1];
                 $notToDelete[] = $throttleId;
                 $arraySave[$throttleId]['max_count'] = $value;
-            } elseif (str_starts_with($key, 'throttle_period_')) {
-                $throttleId = preg_replace('/.*?_(\d+)$/', '$1', $key);
+            } elseif (str_starts_with($key, 'throttle_period_') && preg_match('/^throttle_period_(\d+)$/', $key, $matches)) {
+                $throttleId = $matches[1];
                 $arraySave[$throttleId]['period'] = $value;
             }
         }