| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentCart\App\Http\Requests; |
| 4 |
|
| 5 |
use FluentCart\Framework\Foundation\RequestGuard; |
| 6 |
|
| 7 |
class BulkUpdateVariantRequest extends RequestGuard |
| 8 |
{ |
| 9 |
/** |
| 10 |
* Hard cap on the number of variant rows a single bulk-update call may |
| 11 |
* modify. Matches AdvancedVariationService::DEFAULT_MAX_COMBINATIONS so a |
| 12 |
* caller cannot use the bulk endpoint to write more rows than the editor |
| 13 |
* can generate in the first place. Without this, an unauthenticated-yet- |
| 14 |
* capability-holding attacker could POST a 100K-element array and burn |
| 15 |
* memory + CPU even when every row eventually fails per-row sanitization. |
| 16 |
*/ |
| 17 |
const MAX_UPDATES_PER_REQUEST = 500; |
| 18 |
|
| 19 |
public function rules() |
| 20 |
{ |
| 21 |
return [ |
| 22 |
'updates' => 'required|array', |
| 23 |
]; |
| 24 |
} |
| 25 |
|
| 26 |
public function messages() |
| 27 |
{ |
| 28 |
return [ |
| 29 |
'updates.required' => esc_html__('At least one variant update is required.', 'fluent-cart'), |
| 30 |
'updates.array' => esc_html__('Updates payload must be an array.', 'fluent-cart'), |
| 31 |
]; |
| 32 |
} |
| 33 |
|
| 34 |
public function sanitize() |
| 35 |
{ |
| 36 |
return [ |
| 37 |
// Per-row sanitization (id cast, price->cents, allowlist statuses) lives |
| 38 |
// in ProductVariationController::bulkUpdate where the conditional shape |
| 39 |
// logic belongs. This sanitize() only caps the outer array size — the |
| 40 |
// hard guard against the attack surface where a caller floods the |
| 41 |
// endpoint with millions of rows before any per-row check fires. |
| 42 |
'updates' => function ($value) { |
| 43 |
if (!is_array($value)) { |
| 44 |
return []; |
| 45 |
} |
| 46 |
return array_slice($value, 0, self::MAX_UPDATES_PER_REQUEST); |
| 47 |
}, |
| 48 |
]; |
| 49 |
} |
| 50 |
} |
| 51 |
|
