From d1f205add4169e8bad10eabec63d33c3fbafc9b4 Mon Sep 17 00:00:00 2001 From: ayush00git Date: Sun, 16 Aug 2026 19:41:11 +0530 Subject: [PATCH 1/6] fix: increase signup req/min rate limitm --- routes/auth.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/routes/auth.go b/routes/auth.go index 1cf6d62..d5c0e19 100644 --- a/routes/auth.go +++ b/routes/auth.go @@ -9,7 +9,7 @@ import ( func AuthRoute (e *gin.Engine, h *handlers.AuthHandler) { // maximum of 3 tokens and 1 refill per 15 seconds. - mailRoutesRateLimiter := middleware.NewRateLimiter(3, 1.0/30.0) + mailRoutesRateLimiter := middleware.NewRateLimiter(10, 1.0/30.0) standardRateLimiter := middleware.NewRateLimiter(10, 1.0/6.0) faculty := e.Group("/api/auth/faculty") From 7bdc4bd6c43d832532ee6e80aabb0adf63e4b422 Mon Sep 17 00:00:00 2001 From: ayush00git Date: Sun, 16 Aug 2026 19:41:25 +0530 Subject: [PATCH 2/6] fix: added payload guardrails --- models/admin_auth.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/models/admin_auth.go b/models/admin_auth.go index 91e7743..df6d6fc 100644 --- a/models/admin_auth.go +++ b/models/admin_auth.go @@ -24,6 +24,6 @@ type Admin struct { } type AdminLogin struct { - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` } From e986af601ecd808f6641f685be46cfa28f34658d Mon Sep 17 00:00:00 2001 From: ayush00git Date: Sun, 16 Aug 2026 19:54:39 +0530 Subject: [PATCH 3/6] fix: added payload size guardrails to auth fields --- models/centrehead_auth.go | 14 +++++++------- models/faculty_auth.go | 20 ++++++++++---------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/models/centrehead_auth.go b/models/centrehead_auth.go index a1dee78..266a361 100644 --- a/models/centrehead_auth.go +++ b/models/centrehead_auth.go @@ -40,14 +40,14 @@ type Centrehead struct { } type CentreheadSignup struct { - Name string `json:"name" binding:"required"` - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` - Building BuildingName `json:"building" binding:"required"` - PhoneNumber string `json:"phone_number" binding:"required"` + Name string `json:"name" binding:"required,min=3,max=50"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` + Building BuildingName `json:"building" binding:"required,min=7,max=75"` + PhoneNumber string `json:"phone_number" binding:"required,min=10,max=15"` } type CentreheadLogin struct { - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` } diff --git a/models/faculty_auth.go b/models/faculty_auth.go index 0d3fb4e..8712ce2 100644 --- a/models/faculty_auth.go +++ b/models/faculty_auth.go @@ -57,17 +57,17 @@ type Faculty struct { } type FacultySignup struct { - Name string `json:"name" binding:"required"` - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` - Department DepartmentName `json:"department" binding:"required"` - HouseNumber string `json:"house_number" binding:"required"` - Block BlockLabel `json:"block" binding:"required"` - Type BlockType `json:"type" binding:"required"` - PhoneNumber string `json:"phone_number" binding:"required"` + Name string `json:"name" binding:"required,min=3,max=50"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` + Department DepartmentName `json:"department" binding:"required,min=5,max=50"` + HouseNumber string `json:"house_number" binding:"required,max=4"` + Block BlockLabel `json:"block" binding:"required,max=1"` + Type BlockType `json:"type" binding:"required,max=1"` + PhoneNumber string `json:"phone_number" binding:"required,min=10,max=15"` } type FacultyLogin struct { - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` } From 349f576cd24b8b473ee4421aa70d3897bf220786 Mon Sep 17 00:00:00 2001 From: ayush00git Date: Tue, 18 Aug 2026 22:39:58 +0530 Subject: [PATCH 4/6] fix: applied to models/ dir --- models/post.go | 22 +++++++++++----------- models/warden_auth.go | 14 +++++++------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/models/post.go b/models/post.go index 08efca8..1b8fb10 100644 --- a/models/post.go +++ b/models/post.go @@ -43,10 +43,10 @@ type FacultyPost struct { ID uint `gorm:"primaryKey;autoIncrement" json:"id"` FacultyID uint `gorm:"not null" json:"faculty_id"` Author Faculty `gorm:"foreignKey:FacultyID"` - Place PostPlace `gorm:"type:varchar(20);not null" json:"place" binding:"required"` - TypeOfPost PostType `gorm:"type:varchar(20);not null" json:"type_of_post" binding:"required"` - Title string `gorm:"type:varchar(50);not null" json:"title" binding:"required"` - Description string `gorm:"type:text;not null" json:"description" binding:"required"` + Place PostPlace `gorm:"type:varchar(20);not null" json:"place" binding:"required,max=20"` + TypeOfPost PostType `gorm:"type:varchar(20);not null" json:"type_of_post" binding:"required,max=20"` + Title string `gorm:"type:varchar(50);not null" json:"title" binding:"required,max=50"` + Description string `gorm:"type:text;not null" json:"description" binding:"required,max=5000"` PeopleInThread []string `gorm:"serializer:json;" json:"people_in_thread"` Status string `gorm:"type:varchar(20);not null;default:'pending_xen'" json:"status"` StatusAuditLogs []StatusAudit `gorm:"serializer:json;" json:"status_audit_logs"` @@ -61,10 +61,10 @@ type WardenPost struct { ID uint `gorm:"primaryKey;autoIncrement" json:"id"` WardenID uint `gorm:"not null" json:"warden_id"` Author Warden `gorm:"foreignKey:WardenID"` - RoomNumber string `gorm:"type:varchar(50)" json:"room_number" binding:"required"` - TypeOfPost PostType `gorm:"type:varchar(20);not null" json:"type_of_post" binding:"required"` - Title string `gorm:"not null" json:"title" binding:"required"` - Description string `gorm:"type:text;not null" json:"description" binding:"required"` + RoomNumber string `gorm:"type:varchar(50)" json:"room_number" binding:"required,max=50"` + TypeOfPost PostType `gorm:"type:varchar(20);not null" json:"type_of_post" binding:"required,max=20"` + Title string `gorm:"not null" json:"title" binding:"required,max=50"` + Description string `gorm:"type:text;not null" json:"description" binding:"required,max=5000"` PeopleInThread []string `gorm:"serializer:json;" json:"people_in_thread"` Status string `gorm:"type:varchar(20);not null;default:'pending_xen'" json:"status"` StatusAuditLogs []StatusAudit `gorm:"serializer:json;" json:"status_audit_logs"` @@ -79,9 +79,9 @@ type CentreheadPost struct { ID uint `gorm:"primaryKey;autoIncrement" json:"id"` CentreheadID uint `gorm:"not null" json:"centrehead_id"` Author Centrehead `gorm:"foreignKey:CentreheadID"` - TypeOfPost PostType `gorm:"type:varchar(20);not null" json:"type_of_post" binding:"required"` - Title string `gorm:"not null" json:"title" binding:"required"` - Description string `gorm:"type:text;not null" json:"description" binding:"required"` + TypeOfPost PostType `gorm:"type:varchar(20);not null" json:"type_of_post" binding:"required,max=20"` + Title string `gorm:"not null" json:"title" binding:"required,max=50"` + Description string `gorm:"type:text;not null" json:"description" binding:"required,max=5000"` PeopleInThread []string `gorm:"serializer:json;" json:"people_in_thread"` Status string `gorm:"type:varchar(20);not null;default:'pending_xen'" json:"status"` StatusAuditLogs []StatusAudit `gorm:"serializer:json;" json:"status_audit_logs"` diff --git a/models/warden_auth.go b/models/warden_auth.go index d2423c5..13843d6 100644 --- a/models/warden_auth.go +++ b/models/warden_auth.go @@ -34,14 +34,14 @@ type Warden struct { } type WardenSignup struct { - Name string `json:"name" binding:"required"` - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` - Hostel HostelName `json:"hostel" binding:"required"` - PhoneNumber string `json:"phone_number" binding:"required"` + Name string `json:"name" binding:"required,min=3,max=50"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` + Hostel HostelName `json:"hostel" binding:"required,min=3,max=30"` + PhoneNumber string `json:"phone_number" binding:"required,min=10,max=15"` } type WardenLogin struct { - Email string `json:"email" binding:"required"` - Password string `json:"password" binding:"required"` + Email string `json:"email" binding:"required,email,max=255"` + Password string `json:"password" binding:"required,max=72"` } From f328e098472eb085e6d15454494eb1bd42b009e7 Mon Sep 17 00:00:00 2001 From: ayush00git Date: Tue, 18 Aug 2026 22:49:19 +0530 Subject: [PATCH 5/6] fix: applied payload guards to handlers struct --- handlers/admin_comment.go | 2 +- handlers/admin_status.go | 4 ++-- handlers/centrehead_auth.go | 4 ++-- handlers/centrehead_post.go | 10 +++++----- handlers/faculty_auth.go | 16 ++++++++-------- handlers/faculty_post.go | 14 +++++++------- handlers/warden_auth.go | 6 +++--- handlers/warden_post.go | 14 +++++++------- 8 files changed, 35 insertions(+), 35 deletions(-) diff --git a/handlers/admin_comment.go b/handlers/admin_comment.go index 1a647c0..daa5b1d 100644 --- a/handlers/admin_comment.go +++ b/handlers/admin_comment.go @@ -20,7 +20,7 @@ type AdminHandler struct { } type CommentType struct { - Content string + Content string `binding:"required,max=2000"` } diff --git a/handlers/admin_status.go b/handlers/admin_status.go index a4343ed..12478e8 100644 --- a/handlers/admin_status.go +++ b/handlers/admin_status.go @@ -24,8 +24,8 @@ import ( ) type AdminReview struct { - Review string `json:"Review"` - JeToAssign string `json:"JeToAssign"` + Review string `json:"Review" binding:"required,max=20"` + JeToAssign string `json:"JeToAssign" binding:"omitempty,email,max=255"` } // PostStatus diff --git a/handlers/centrehead_auth.go b/handlers/centrehead_auth.go index 4932dbd..9fe2075 100644 --- a/handlers/centrehead_auth.go +++ b/handlers/centrehead_auth.go @@ -15,8 +15,8 @@ import ( ) type CentreheadProfileEditType struct { - Building string `json:"building"` - PhoneNumber string `json:"phone_number"` + Building string `json:"building" binding:"omitempty,min=7,max=75"` + PhoneNumber string `json:"phone_number" binding:"omitempty,min=10,max=15"` } diff --git a/handlers/centrehead_post.go b/handlers/centrehead_post.go index f3be58b..baa7fc5 100644 --- a/handlers/centrehead_post.go +++ b/handlers/centrehead_post.go @@ -18,16 +18,16 @@ import ( // CentreheadPostEditType type CentreheadPostEditType struct { - Title string `json:"title"` - Description string `json:"description"` + Title string `json:"title" binding:"omitempty,max=50"` + Description string `json:"description" binding:"omitempty,max=5000"` UpdatedAt time.Time `json:"updated_at"` } // CentreheadPostType type CentreheadPostType struct { - Title string `json:"title"` - Description string `json:"description"` - TypeOfPost string `json:"type_of_post"` + Title string `json:"title" binding:"required,max=50"` + Description string `json:"description" binding:"required,max=5000"` + TypeOfPost string `json:"type_of_post" binding:"required,max=20"` } // CentreheadPost registers the post of centre-head members. diff --git a/handlers/faculty_auth.go b/handlers/faculty_auth.go index 121e5f2..a83c627 100644 --- a/handlers/faculty_auth.go +++ b/handlers/faculty_auth.go @@ -19,20 +19,20 @@ type AuthHandler struct { } type ResetPassword struct { - Password string `json:"password" binding:"required"` + Password string `json:"password" binding:"required,max=72"` } type ForgetPassword struct { - Email string `json:"email" binding:"required"` + Email string `json:"email" binding:"required,email,max=255"` } type FacultyProfileEditType struct { - Name string `json:"name"` - Department string `json:"department"` - HouseNumber string `json:"house_number"` - Block string `json:"block"` - Type string `json:"type"` - PhoneNumber string `json:"phone_number"` + Name string `json:"name" binding:"omitempty,min=3,max=50"` + Department string `json:"department" binding:"omitempty,min=5,max=50"` + HouseNumber string `json:"house_number" binding:"omitempty,max=4"` + Block string `json:"block" binding:"omitempty,max=1"` + Type string `json:"type" binding:"omitempty,max=1"` + PhoneNumber string `json:"phone_number" binding:"omitempty,min=10,max=15"` } // FacultySignup registers a new faculty member. diff --git a/handlers/faculty_post.go b/handlers/faculty_post.go index 8131749..ba35ec4 100644 --- a/handlers/faculty_post.go +++ b/handlers/faculty_post.go @@ -22,17 +22,17 @@ type PostHandler struct { // FacultyPostType type FacultyPostType struct { - Place string `json:"place"` - TypeOfPost string `json:"type_of_post"` - Title string `json:"title"` - Description string `json:"description"` + Place string `json:"place" binding:"required,max=20"` + TypeOfPost string `json:"type_of_post" binding:"required,max=20"` + Title string `json:"title" binding:"required,max=50"` + Description string `json:"description" binding:"required,max=5000"` } // FacultyPostEditType type FacultyPostEditType struct { - Place string `json:"place"` - Title string `json:"title"` - Description string `json:"description"` + Place string `json:"place" binding:"omitempty,max=20"` + Title string `json:"title" binding:"omitempty,max=50"` + Description string `json:"description" binding:"omitempty,max=5000"` UpdatedAt time.Time `json:"updated_at"` } diff --git a/handlers/warden_auth.go b/handlers/warden_auth.go index 5401b01..6add15b 100644 --- a/handlers/warden_auth.go +++ b/handlers/warden_auth.go @@ -15,9 +15,9 @@ import ( ) type WardenProfileEditType struct { - Name string `json:"name"` - Hostel string `json:"hostel"` - PhoneNumber string `json:"phone_number"` + Name string `json:"name" binding:"omitempty,min=3,max=50"` + Hostel string `json:"hostel" binding:"omitempty,min=3,max=30"` + PhoneNumber string `json:"phone_number" binding:"omitempty,min=10,max=15"` } diff --git a/handlers/warden_post.go b/handlers/warden_post.go index 414c31b..a56ff6b 100644 --- a/handlers/warden_post.go +++ b/handlers/warden_post.go @@ -18,18 +18,18 @@ import ( // WardenPostEditType type WardenPostEditType struct { - RoomNumber string `json:"room_number"` - Title string `json:"title"` - Description string `json:"description"` + RoomNumber string `json:"room_number" binding:"omitempty,max=50"` + Title string `json:"title" binding:"omitempty,max=50"` + Description string `json:"description" binding:"omitempty,max=5000"` UpdatedAt time.Time `json:"updated_at"` } // WardenPostType type WardenPostType struct { - TypeOfPost string `json:"type_of_post"` - RoomNumber string `json:"room_number"` - Title string `json:"title"` - Description string `json:"description"` + TypeOfPost string `json:"type_of_post" binding:"required,max=20"` + RoomNumber string `json:"room_number" binding:"required,max=50"` + Title string `json:"title" binding:"required,max=50"` + Description string `json:"description" binding:"required,max=5000"` } From ebb68b3d679a92c8eb73d9357a5c36ba5e0f57ea Mon Sep 17 00:00:00 2001 From: ayush00git Date: Tue, 18 Aug 2026 22:57:50 +0530 Subject: [PATCH 6/6] fix: applied counters to input fields --- app/src/components/CommentBox.tsx | 36 +++++++++++++++------------ app/src/pages/admin/AdminPostView.tsx | 5 +++- app/src/pages/post/CentreHeadPost.tsx | 12 +++++++-- app/src/pages/post/FacultyPost.tsx | 11 ++++++-- app/src/pages/post/PostView.tsx | 21 +++++++++++++--- app/src/pages/post/WardenPost.tsx | 12 +++++++-- 6 files changed, 70 insertions(+), 27 deletions(-) diff --git a/app/src/components/CommentBox.tsx b/app/src/components/CommentBox.tsx index 30d00ad..9bcc89d 100644 --- a/app/src/components/CommentBox.tsx +++ b/app/src/components/CommentBox.tsx @@ -157,24 +157,28 @@ export function CommentBox({ onChange={(e) => onEditingTextChange?.(e.target.value)} disabled={isBusy} rows={2} + maxLength={2000} className="w-full text-[12.5px] text-zinc-800 bg-white border border-zinc-200 rounded-lg px-3 py-2.5 focus:outline-none focus:ring-4 focus:ring-zinc-800/5 focus:border-zinc-400 transition resize-none" /> -
- - +
+ {editingText.length}/2000 +
+ + +
) : ( diff --git a/app/src/pages/admin/AdminPostView.tsx b/app/src/pages/admin/AdminPostView.tsx index ee4bd3a..35c3fef 100644 --- a/app/src/pages/admin/AdminPostView.tsx +++ b/app/src/pages/admin/AdminPostView.tsx @@ -905,13 +905,16 @@ export function AdminPostView() { ? 'Add a comment and select an action below...' : 'No actions available.'} rows={3} + maxLength={2000} className="w-full text-[13px] text-zinc-800 placeholder-zinc-400 bg-transparent px-4 py-3.5 resize-none focus:outline-none disabled:opacity-50 disabled:cursor-not-allowed" /> {/* Bottom Toolbar */}
- + Comment & Update Status + · + {commentText.length}/2000 {/* Action buttons */} diff --git a/app/src/pages/post/CentreHeadPost.tsx b/app/src/pages/post/CentreHeadPost.tsx index 25fa78d..4f84210 100644 --- a/app/src/pages/post/CentreHeadPost.tsx +++ b/app/src/pages/post/CentreHeadPost.tsx @@ -118,7 +118,10 @@ export function CentreHeadPost() {

Title & Description

- +
+ + {formData.title.length}/50 +
- +
+ + {formData.description.length}/5000 +