Do not error out when receiving UIDs > INT_MAX1.1.2

2 files changed, 16 insertions, 1 deletions

diff --git a/lib/Travelynx/Controller/Account.pm b/lib/Travelynx/Controller/Account.pm
index f7d3a75..081aa13 100644
--- a/lib/Travelynx/Controller/Account.pm
+++ b/lib/Travelynx/Controller/Account.pm
@@ -159,7 +159,7 @@ sub verify {
 	my $id    = $self->stash('id');
 	my $token = $self->stash('token');
 
-	if ( not $id =~ m{ ^ \d+ $ }x ) {
+	if ( not $id =~ m{ ^ \d+ $ }x or $id > 2147483647 ) {
 		$self->render( 'register', invalid => 'token' );
 		return;
 	}
@@ -528,6 +528,11 @@ sub recover_password {
 	my $id    = $self->stash('id');
 	my $token = $self->stash('token');
 
+	if ( not $id =~ m{ ^ \d+ $ }x or $id > 2147483647 ) {
+		$self->render( 'recover_password', invalid => 'recovery token' );
+		return;
+	}
+
 	if ( $self->verify_password_token( $id, $token ) ) {
 		$self->render('set_password');
 	}
diff --git a/lib/Travelynx/Controller/Api.pm b/lib/Travelynx/Controller/Api.pm
index 889a0e3..b0047b9 100755
--- a/lib/Travelynx/Controller/Api.pm
+++ b/lib/Travelynx/Controller/Api.pm
@@ -122,6 +122,16 @@ sub get_v1 {
 	}
 	my $uid = $+{id};
 	$api_token = $+{token};
+
+	if ( $uid > 2147483647 ) {
+		$self->render(
+			json => {
+				error => 'Malformed token',
+			},
+		);
+		return;
+	}
+
 	my $token = $self->get_api_token($uid);
 	if ( $api_token ne $token->{$api_action} ) {
 		$self->render(