From 97f258fabb3ebfa7acc7c02cb59de92b01710f99 Mon Sep 17 00:00:00 2001
From: "Andrew Davis (andyjdavis)" <andrew@moodle.com>
Date: Wed, 14 Sep 2011 16:04:40 +0800
Subject: [PATCH] MDL-29311 messaging: added a safety check to prevent message
 refreshing causing inadvertant DOS

---
 message/refresh.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/message/refresh.php b/message/refresh.php
index 88532dee93a..2ee38b72496 100644
--- a/message/refresh.php
+++ b/message/refresh.php
@@ -19,6 +19,12 @@
     $userfullname = strip_tags(required_param('name', PARAM_RAW));
     $wait         = optional_param('wait', MESSAGE_DEFAULT_REFRESH, PARAM_INT);
 
+    if ($wait < 1) {
+        //this should not happen unless someone is manually constructing URLs
+        //allowing a wait of 0 causes continuous GET requests
+        $wait = MESSAGE_DEFAULT_REFRESH;
+    }
+
     $stylesheetshtml = '';
     foreach ($CFG->stylesheets as $stylesheet) {
         $stylesheetshtml .= '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'" />';