From 325a886a5d84c42c67e7075c734b74619d383ea2 Mon Sep 17 00:00:00 2001
From: Carl Worth <cworth@cworth.org>
Date: Thu, 11 Jun 2020 17:06:28 -0700
Subject: [PATCH] Empathy: Reject categories with more than 20 items

Just to avoid any smart aleck trying to get every player's browser to
try to render a million text input fields.
---
 empathy.js | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/empathy.js b/empathy.js
index 1da9b8e..25d8f77 100644
--- a/empathy.js
+++ b/empathy.js
@@ -1,6 +1,8 @@
 const express = require("express");
 const Game = require("./game.js");
 
+const MAX_PROMPT_ITEMS = 20;
+
 class Empathy extends Game {
   constructor(id) {
     super(id);
@@ -55,6 +57,12 @@ class Empathy extends Game {
   }
 
   add_prompt(items, prompt_string) {
+    if (items > MAX_PROMPT_ITEMS)
+      return {
+        valid: false,
+        message: `Maximum number of items is ${MAX_PROMPT_ITEMS}`
+      };
+
     const prompt = new Prompt(this.next_prompt_id, items, prompt_string);
     this.next_prompt_id++;
 
@@ -62,7 +70,10 @@ class Empathy extends Game {
 
     this.broadcast_event_object('prompt', prompt);
 
-    return prompt;
+    return {
+      valid: true,
+      id: prompt.id
+    };
   }
 
   /* Returns true if vote toggled, false for player or prompt not found */
@@ -326,9 +337,9 @@ class Prompt {
 router.post('/prompts', (request, response) => {
   const game = request.game;
 
-  prompt = game.add_prompt(request.body.items, request.body.prompt);
+  const result = game.add_prompt(request.body.items, request.body.prompt);
 
-  response.json({ id: prompt.id});
+  response.json(result);
 });
 
 router.post('/vote/:prompt_id([0-9]+)', (request, response) => {
-- 
2.43.0