(vcl) branch develop updated: VCL-1147 - setting Max Reservation Duration for an image can give a user longer access than they should have

[jfthomps]

This is an automated email from the ASF dual-hosted git repository.

jfthomps pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/vcl.git


The following commit(s) were added to refs/heads/develop by this push:
     new 695e3f15 VCL-1147 - setting Max Reservation Duration for an image can 
give a user longer access than they should have
695e3f15 is described below

commit 695e3f15829f4ea8d9bbebb18090eb199489d657
Author: Josh Thompson <jftho...@ncsu.edu>
AuthorDate: Fri Feb 23 16:09:10 2024 -0500

    VCL-1147 - setting Max Reservation Duration for an image can give a user 
longer access than they should have
    
    requests.php: modified AJeditRequest: added check for $maximglen < 
$maxtimes['total'] before setting maxtimes['total'] = $maximglen
---
 web/.ht-inc/requests.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/.ht-inc/requests.php b/web/.ht-inc/requests.php
index 2550e172..84d175ad 100644
--- a/web/.ht-inc/requests.php
+++ b/web/.ht-inc/requests.php
@@ -3440,7 +3440,7 @@ function AJeditRequest() {
        $lengths = array();
        if($request['forimaging'] && $maxtimes['total'] < 720) # make sure at 
least 12 hours available for imaging reservations
                $maxtimes['total'] = 720;
-       elseif(! $request['forimaging'] && $maximglen) {
+       elseif(! $request['forimaging'] && $maximglen && ($maximglen < 
$maxtimes['total'])) {
                $maxtimes['total'] = $maximglen;
                $currduration = (datetimeToUnix($request['end']) - 
datetimeToUnix($request['start'])) / 60;
                $maxtimes['extend'] = $maximglen - $currduration;