From f4203b7408e404e0e7e14cefa8c1b0c34fa9ea96 Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Mon, 10 Jul 2023 15:11:49 +0200
Subject: [PATCH] Vouchers: Don't allow to generate more than 100k random codes
 at once

---
 src/pretix/control/templates/pretixcontrol/vouchers/bulk.html | 2 +-
 src/pretix/control/views/vouchers.py                          | 2 ++
 src/pretix/static/pretixcontrol/js/ui/main.js                 | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/pretix/control/templates/pretixcontrol/vouchers/bulk.html b/src/pretix/control/templates/pretixcontrol/vouchers/bulk.html
index 03af1073ec..ba7cdc4e04 100644
--- a/src/pretix/control/templates/pretixcontrol/vouchers/bulk.html
+++ b/src/pretix/control/templates/pretixcontrol/vouchers/bulk.html
@@ -17,7 +17,7 @@
                            placeholder="{% trans "Prefix (optional)" %}">
                     <div class="input-group">
                         <input type="number" class="form-control input-xs"
-                               id="voucher-bulk-codes-num"
+                               id="voucher-bulk-codes-num" max="100000"
                                placeholder="{% trans "Number" context "number_of_things" %}">
                         <div class="input-group-btn">
                             <button class="btn btn-default" type="button" id="voucher-bulk-codes-generate"
diff --git a/src/pretix/control/views/vouchers.py b/src/pretix/control/views/vouchers.py
index 8c7f7248ac..d354a7fc36 100644
--- a/src/pretix/control/views/vouchers.py
+++ b/src/pretix/control/views/vouchers.py
@@ -569,6 +569,8 @@ class VoucherRNG(EventPermissionRequiredMixin, View):
     def get(self, request, *args, **kwargs):
         try:
             num = int(request.GET.get('num', '5'))
+            if num > 100_000:
+                return HttpResponseBadRequest()
         except ValueError:  # NOQA
             return HttpResponseBadRequest()
 
diff --git a/src/pretix/static/pretixcontrol/js/ui/main.js b/src/pretix/static/pretixcontrol/js/ui/main.js
index 73526c2132..2ecf8c5c9c 100644
--- a/src/pretix/static/pretixcontrol/js/ui/main.js
+++ b/src/pretix/static/pretixcontrol/js/ui/main.js
@@ -123,6 +123,8 @@ var form_handlers = function (el) {
 
     // Vouchers
     el.find("#voucher-bulk-codes-generate").click(function () {
+        if (!$("#voucher-bulk-codes-num").get(0).reportValidity())
+            return;
         var num = $("#voucher-bulk-codes-num").val();
         var prefix = $('#voucher-bulk-codes-prefix').val();
         if (num != "") {