From c974e394d86efab4dcfdfdfce875b3af299a8b25 Mon Sep 17 00:00:00 2001
From: Kai Lauterbach <klaute@gmx.de>
Date: Fri, 12 May 2023 11:43:27 +0200
Subject: [PATCH] Added range checks

---
 firmware/firmware.ino | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/firmware/firmware.ino b/firmware/firmware.ino
index 3348974..d157bb0 100644
--- a/firmware/firmware.ino
+++ b/firmware/firmware.ino
@@ -405,6 +405,13 @@ void init_webserver()
       {
         const char* key = state.key().c_str();
         int light = atoi(key) - 1;
+        if (light < 0)
+        {
+          light = 0;
+        } else if (light > (LIGHTS_COUNT-1))
+        {
+          light = (LIGHTS_COUNT-1);
+        }
         JsonObject values = state.value();
 
         uint8_t tmp = EEPROM.read(EEPROM_LAST_STATE_STARTUP_ADDRESS);
@@ -441,6 +448,10 @@ void init_webserver()
         if (values.containsKey("transitiontime"))
         {
           default_transitiontime = values["transitiontime"];
+          if (default_transitiontime < 0)
+          {
+            default_transitiontime = 0;
+          }
           if (tc_enabled == TIMING_CONTROL_DISABLED)
           {
             for (uint8_t i = 0 ; i < LIGHTS_COUNT; i++)
@@ -461,6 +472,13 @@ void init_webserver()
   server.on("/state", HTTP_GET, []()
   {  // HTTP GET request used to fetch current light state
     uint8_t light = server.arg("light").toInt() - 1;
+    if (light < 0)
+    {
+      light = 0;
+    } else if (light > (LIGHTS_COUNT-1))
+    {
+      light = (LIGHTS_COUNT-1);
+    }
     DynamicJsonDocument root(512);
     root["on"]     = light_state[light];
     root["bri"]    = bri[light];
@@ -536,6 +554,10 @@ void init_webserver()
     if (server.hasArg("transition"))
     {
       default_transitiontime = server.arg("transition").toFloat();
+      if (default_transitiontime < 0)
+      {
+        default_transitiontime = 0;
+      }
       if (tc_enabled == TIMING_CONTROL_DISABLED)
       {
         for (uint8_t i = 0 ; i < LIGHTS_COUNT; i++)
@@ -610,9 +632,11 @@ void init_webserver()
     }
 
     // scene switch handling
-    if (server.hasArg("scene")) {
+    if (server.hasArg("scene"))
+    {
       scene = server.arg("scene").toInt();
-      if (EEPROM.read(EEPROM_SCENE_ADDRESS) != scene) {
+      if (EEPROM.read(EEPROM_SCENE_ADDRESS) != scene)
+      {
         EEPROM.write(EEPROM_SCENE_ADDRESS, scene);
         EEPROM.commit();
         Serial.print("Scene set to ");
@@ -623,7 +647,8 @@ void init_webserver()
     if (server.hasArg("dip")) {
       uint8_t tmp = EEPROM.read(EEPROM_DYNAMIC_IP_ADDRESS);
       uint8_t tmp2 = (server.arg("dip") == "true" ? 1 : 0);
-      if (tmp != tmp2) {
+      if (tmp != tmp2)
+      {
         EEPROM.write(EEPROM_DYNAMIC_IP_ADDRESS, tmp2);
         EEPROM.commit();
         Serial.print("Set dynamic IP to ");