Merge pull request from GHSA-2m59-c483-c8qj

Disallow submitting more than four flights in a single request

Author: jpatokal

openflights.js

@@ -3867,6 +3867,7 @@ function selectAirport(apid, select, quick, code) {
 function changeRows(type) {
   switch (type) {
     case "More":
+      // NOTE: also change the limit in submit.php to support more flights in a single request
       if (multiinput_rows >= 3) {
         $("b_more").disabled = true;
       }

php/submit.php

@@ -23,7 +23,7 @@
 $mode = $_POST["mode"];
 $note = stripslashes($_POST["note"]);
 $param = $_POST["param"];
-$multi = $_POST["multi"] ?? false;
+$multi = intval($_POST["multi"]);
 
 if (!$mode || $mode == "") {
     $mode = "F";
@@ -83,8 +83,8 @@
 $num_added = 0;
 switch ($param) {
     case "ADD":
-        // Can add multiple flights or just one
-        if ($multi) {
+        // Can add multiple (at most 4) flights or just one
+        if ($multi >= 1 && $multi <= 4) {
             for ($idx = 0; $idx < $multi; $idx++) {
                 $rows[$idx] = $idx + 1;
             }