From 04916780550d6d815f32a03c4d85401a846a966a Mon Sep 17 00:00:00 2001
From: Mia Winter <mia@miawinter.de>
Date: Fri, 9 Feb 2024 11:55:32 +0100
Subject: [PATCH] Improved UserController validation

---
 Wave/Controllers/UserController.cs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Wave/Controllers/UserController.cs b/Wave/Controllers/UserController.cs
index 8ea9a97..1c9a986 100644
--- a/Wave/Controllers/UserController.cs
+++ b/Wave/Controllers/UserController.cs
@@ -1,4 +1,5 @@
-using ImageMagick;
+using System.ComponentModel.DataAnnotations;
+using ImageMagick;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.OutputCaching;
@@ -18,7 +19,7 @@ public class UserController(ImageService imageService, IDbContextFactory<Applica
 	[OutputCache(Duration = 60*5)]
 	[ResponseCache(Duration = 60*5, Location = ResponseCacheLocation.Any)]
 	[Route("pfp/{userId}")]
-	public async Task<IActionResult> Get(string userId, [FromQuery] int size = 800) {
+	public async Task<IActionResult> Get(string userId, [FromQuery, Range(16, 800)] int size = 800) {
 		if (size > 800) size = 800;
 		await using var context = await ContextFactory.CreateDbContextAsync();
 		var user = await context.Users.Include(u => u.ProfilePicture).FirstOrDefaultAsync(u => u.Id == userId);