Fix: restrict user to extract more than 24 hour active projects

hotosm · Dec 28, 2023 · c9fb313 · c9fb313
1 parent 0a3e152
commit c9fb313
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/backend/api/projects/resources.py b/backend/api/projects/resources.py
@@ -1199,7 +1199,13 @@ def get(self):
         """
         interval = request.args.get("interval", "24")
         if not interval.isdigit():
-            return {"Error": "Interval must be a number greater than 0"}, 400
+            return {
+                "Error": "Interval must be a number greater than 0 and less than or equal to 24"
+            }, 400
         interval = int(interval)
+        if interval <= 0 or interval > 24:
+            return {
+                "Error": "Interval must be a number greater than 0 and less than or equal to 24"
+            }, 400
         projects_dto = ProjectService.get_active_projects(interval)
         return projects_dto, 200