diff --git a/admin/app/controllers/maps_controller.ts b/admin/app/controllers/maps_controller.ts index f5fb0f3..dd93a8b 100644 --- a/admin/app/controllers/maps_controller.ts +++ b/admin/app/controllers/maps_controller.ts @@ -137,9 +137,11 @@ export default class MapsController { vine.compile( vine.object({ name: vine.string().trim().minLength(1).maxLength(255), - longitude: vine.number(), - latitude: vine.number(), + longitude: vine.number().min(-180).max(180), + latitude: vine.number().min(-90).max(90), color: vine.string().trim().maxLength(20).optional(), + notes: vine.string().trim().nullable().optional(), + marker_type: vine.string().trim().maxLength(20).optional(), }) ) ) @@ -148,6 +150,8 @@ export default class MapsController { longitude: payload.longitude, latitude: payload.latitude, color: payload.color ?? 'orange', + notes: payload.notes ?? null, + marker_type: payload.marker_type ?? 'pin', }) return marker } @@ -163,11 +167,19 @@ export default class MapsController { vine.object({ name: vine.string().trim().minLength(1).maxLength(255).optional(), color: vine.string().trim().maxLength(20).optional(), + longitude: vine.number().min(-180).max(180).optional(), + latitude: vine.number().min(-90).max(90).optional(), + notes: vine.string().trim().nullable().optional(), + marker_type: vine.string().trim().maxLength(20).optional(), }) ) ) if (payload.name !== undefined) marker.name = payload.name if (payload.color !== undefined) marker.color = payload.color + if (payload.longitude !== undefined) marker.longitude = payload.longitude + if (payload.latitude !== undefined) marker.latitude = payload.latitude + if (payload.notes !== undefined) marker.notes = payload.notes + if (payload.marker_type !== undefined) marker.marker_type = payload.marker_type await marker.save() return marker } diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md index c8c2766..164a22d 100644 --- a/admin/docs/release-notes.md +++ b/admin/docs/release-notes.md @@ -11,6 +11,7 @@ - **Downloads**: Downloads are now staged to .tmp files and atomically renamed upon completion to prevent issues with incomplete/corrupt files. Thanks @artbird309 for the contribution! - **Downloads**: Removed a duplicate error listener and improved stability when handling Range requests for file downloads. Thanks @jakeaturner for the contribution! - **Downloads**: Added improved handling for corrupt ZIM file downloads and removed duplicate Ollama download logs. Thanks @aegisman for the contribution! +- **Maps**: Fixed an issue where the markers API silently dropped the `notes` and `marker_type` fields when creating or updating a marker, and where marker position could not be changed via the update endpoint. Thanks @jrsphoto for the bug report and fix! - **Security**: Closed a potential SSRF vulnerability in the map file download functionality by implementing stricter URL validation and blocking private IP ranges. Thanks @LuisMIguelFurlanettoSousa for the fix! - **Security**: Sanitized error messages from the backend to prevent potential information disclosure. Thanks @LuisMIguelFurlanettoSousa for the fix!