[statistics] Sanitize live values from client

1 files changed, 5 insertions, 1 deletions

diff --git a/modules-available/statistics/api.inc.php b/modules-available/statistics/api.inc.php
index f519380f..18a58a77 100644
--- a/modules-available/statistics/api.inc.php
+++ b/modules-available/statistics/api.inc.php
@@ -245,13 +245,17 @@ if ($type[0] === '~') {
 						'memfree', 'tmpfree', 'swapfree', 'id45free',
 						'cpuload', 'cputemp'] as $item) {
 			$liveVal = Request::post($item, false, 'int');
-			if ($liveVal !== false) {
+			if ($liveVal !== false && $liveVal >= 0) {
 				$strUpdateBoottime .= ' live_' . $item . ' = :live_' . $item . ', ';
 				if ($item === 'cpuload' || $item === 'cputemp') {
 					$liveVal = round($liveVal);
 				} else {
 					$liveVal = ceil($liveVal / 1024);
 				}
+				$max = ($item === 'cpuload') ? 100 : (2 ** 31);
+				if ($liveVal > $max) {
+					$liveVal = $max;
+				}
 				$params['live_' . $item] = $liveVal;
 			}
 		}