Merge branch 'QA_4_6-security' into master-security

1 files changed, 5 insertions, 2 deletions

diff --git a/tbl_addfield.php b/tbl_addfield.php
index 2ec8a2972b..2996d147ab 100644
--- a/tbl_addfield.php
+++ b/tbl_addfield.php
@@ -43,10 +43,13 @@ if (isset($_REQUEST['submit_num_fields'])) {
     if (isset($_REQUEST['orig_field_where'])) {
         $_REQUEST['field_where'] = $_REQUEST['orig_field_where'];
     }
-    $num_fields = $_REQUEST['orig_num_fields'] + $_REQUEST['added_fields'];
+    $num_fields = min(
+        intval($_REQUEST['orig_num_fields']) + intval($_REQUEST['added_fields']),
+        4096
+    );
     $regenerate = true;
 } elseif (isset($_REQUEST['num_fields']) && intval($_REQUEST['num_fields']) > 0) {
-    $num_fields = (int) $_REQUEST['num_fields'];
+    $num_fields = min(4096, intval($_REQUEST['num_fields']));
 } else {
     $num_fields = 1;
 }