addItemsSubmit() reads the number of items to add from $element['add']['more_items']['#value'] and stores it directly into form state without any server-side bound. The HTML #max attribute on the number input prevents this in normal browser usage, but a crafted POST request (or JavaScript manipulation of the max attribute) can submit an arbitrarily large value.

Issue fork element_multiple-3590246

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

facine created an issue. See original summary.

facine opened merge request !12

  • facine committed 7caa52e0 on 1.x 
    fix: #3590246 Clamp more_items server-side against #cardinality in...
facine’s picture

facine commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.