From a921cfc95a407edd87dd96a3929707de6a9ca948 Mon Sep 17 00:00:00 2001
From: Torsten Dittmann <torsten.dittmann@googlemail.com>
Date: Mon, 9 May 2022 14:28:43 +0200
Subject: [PATCH] fix: input validation

---
 app/views/console/functions/function.phtml | 4 ++--
 app/views/console/webhooks/webhook.phtml   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/console/functions/function.phtml b/app/views/console/functions/function.phtml
index ed0b12b215..4914710555 100644
--- a/app/views/console/functions/function.phtml
+++ b/app/views/console/functions/function.phtml
@@ -629,12 +629,12 @@ foreach ($events as $name => $event) {
                             </select>
                             <div x-show="hasResource">
                                 <label x-text="'Select ' + resourceName + ' (optional)'"></label>
-                                <input type="text" :placeholder="resourceName" x-model="resource">
+                                <input type="text" :placeholder="resourceName" x-model="resource" maxlength="36" pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,35}$">
                                 <div class="text-fade text-size-xs margin-top-negative-small margin-bottom">Leave empty for wildcard access</div>
                             </div>
                             <div x-show="hasSubResource">
                                 <label x-text="'Select ' + subResourceName + ' (optional)'"></label>
-                                <input type="text" :placeholder="subResourceName" x-model="subResource">
+                                <input type="text" :placeholder="subResourceName" x-model="subResource" maxlength="36" pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,35}$">
                                 <div class="text-fade text-size-xs margin-top-negative-small margin-bottom">Leave empty for wildcard access</div>
                             </div>
                             <div x-show="hasAttribute">
diff --git a/app/views/console/webhooks/webhook.phtml b/app/views/console/webhooks/webhook.phtml
index 3032498da3..78f02822a3 100644
--- a/app/views/console/webhooks/webhook.phtml
+++ b/app/views/console/webhooks/webhook.phtml
@@ -169,12 +169,12 @@ foreach ($events as $name => $event) {
                         </select>
                         <div x-show="hasResource">
                             <label x-text="'Select ' + resourceName + ' (optional)'"></label>
-                            <input type="text" :placeholder="resourceName" x-model="resource">
+                            <input type="text" :placeholder="resourceName" x-model="resource" maxlength="36" pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,35}$">
                             <div class="text-fade text-size-xs margin-top-negative-small margin-bottom">Leave empty for wildcard access</div>
                         </div>
                         <div x-show="hasSubResource">
                             <label x-text="'Select ' + subResourceName + ' (optional)'"></label>
-                            <input type="text" :placeholder="subResourceName" x-model="subResource">
+                            <input type="text" :placeholder="subResourceName" x-model="subResource" maxlength="36" pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,35}$">
                             <div class="text-fade text-size-xs margin-top-negative-small margin-bottom">Leave empty for wildcard access</div>
                         </div>
                         <div x-show="hasAttribute">