From b273e06e8842d0ee21d07fd0402bac2fafc52279 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gina=20H=C3=A4u=C3=9Fge?= <osd@foosel.net>
Date: Tue, 24 Feb 2015 19:24:11 +0100
Subject: [PATCH] Server side range checking for timelapse config

---
 src/octoprint/server/api/timelapse.py | 34 ++++++++++++++++++---------
 src/octoprint/timelapse.py            |  6 ++---
 2 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/src/octoprint/server/api/timelapse.py b/src/octoprint/server/api/timelapse.py
index 4d2c5369..89a131fa 100644
--- a/src/octoprint/server/api/timelapse.py
+++ b/src/octoprint/server/api/timelapse.py
@@ -7,7 +7,7 @@ __copyright__ = "Copyright (C) 2014 The OctoPrint Project - Released under terms
 
 import os
 
-from flask import request, jsonify, url_for
+from flask import request, jsonify, url_for, make_response
 from werkzeug.utils import secure_filename
 
 import octoprint.timelapse
@@ -79,26 +79,38 @@ def setTimelapseConfig():
 
 		if "postRoll" in request.values:
 			try:
-				config["postRoll"] = int(request.values["postRoll"])
+				postRoll = int(request.values["postRoll"])
 			except ValueError:
-				pass
+				return make_response("Invalid value for postRoll: %r" % request.values["postRoll"], 400)
+			else:
+				if postRoll >= 0:
+					config["postRoll"] = postRoll
+				else:
+					return make_response("Invalid value for postRoll: %d" % postRoll, 400)
 
 		if "fps" in request.values:
 			try:
-				config["fps"] = int(request.values["fps"])
+				fps = int(request.values["fps"])
 			except ValueError:
-				pass
+				return make_response("Invalid value for fps: %r" % request.values["fps"], 400)
+			else:
+				if fps > 0:
+					config["fps"] = fps
+				else:
+					return make_response("Invalid value for fps: %d" % fps, 400)
 
 		if "interval" in request.values:
-			interval = 10
 			try:
 				interval = int(request.values["interval"])
 			except ValueError:
-				pass
-
-			config["options"] = {
-				"interval": interval
-			}
+				return make_response("Invalid value for interval: %r" % request.values["interval"])
+			else:
+				if interval > 0:
+					config["options"] = {
+						"interval": interval
+					}
+				else:
+					return make_response("Invalid value for interval: %d" % interval)
 
 		if admin_permission.can() and "save" in request.values and request.values["save"] in valid_boolean_trues:
 			octoprint.timelapse.configureTimelapse(config, True)
diff --git a/src/octoprint/timelapse.py b/src/octoprint/timelapse.py
index 6e9c371d..1c545dde 100644
--- a/src/octoprint/timelapse.py
+++ b/src/octoprint/timelapse.py
@@ -76,11 +76,11 @@ def configureTimelapse(config=None, persist=False):
 	type = config["type"]
 
 	postRoll = 0
-	if "postRoll" in config:
+	if "postRoll" in config and config["postRoll"] >= 0:
 		postRoll = config["postRoll"]
 
 	fps = 25
-	if "fps" in config:
+	if "fps" in config and config["fps"] > 0:
 		fps = config["fps"]
 
 	if type is None or "off" == type:
@@ -89,7 +89,7 @@ def configureTimelapse(config=None, persist=False):
 		current = ZTimelapse(postRoll=postRoll, fps=fps)
 	elif "timed" == type:
 		interval = 10
-		if "options" in config and "interval" in config["options"]:
+		if "options" in config and "interval" in config["options"] and config["options"]["interval"] > 0:
 			interval = config["options"]["interval"]
 		current = TimedTimelapse(postRoll=postRoll, interval=interval, fps=fps)