From d9a48d66f977afbe9d5e196e9e22d882b16b3566 Mon Sep 17 00:00:00 2001
From: mmd-osm <mmd.osm@gmail.com>
Date: Sat, 3 Nov 2018 18:32:02 +0100
Subject: [PATCH] Limit notes sizes to 2000 characters

---
 app/models/note_comment.rb         | 3 ++-
 app/views/browse/new_note.html.erb | 2 +-
 app/views/browse/note.html.erb     | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/models/note_comment.rb b/app/models/note_comment.rb
index f8450d0a3..c9caa1b85 100644
--- a/app/models/note_comment.rb
+++ b/app/models/note_comment.rb
@@ -33,7 +33,8 @@ class NoteComment < ActiveRecord::Base
   validates :visible, :inclusion => [true, false]
   validates :author, :associated => true
   validates :event, :inclusion => %w[opened closed reopened commented hidden]
-  validates :body, :format => /\A[^\x00-\x08\x0b-\x0c\x0e-\x1f\x7f\ufffe\uffff]*\z/
+  validates :body, :allow_blank => false, :length => { :maximum => 2000 },
+                   :format => /\A[^\x00-\x08\x0b-\x0c\x0e-\x1f\x7f\ufffe\uffff]*\z/
 
   # Return the comment text
   def body
diff --git a/app/views/browse/new_note.html.erb b/app/views/browse/new_note.html.erb
index f6518daf2..e8b64b705 100644
--- a/app/views/browse/new_note.html.erb
+++ b/app/views/browse/new_note.html.erb
@@ -10,7 +10,7 @@
   <form action="#">
     <input type="hidden" name="lon">
     <input type="hidden" name="lat">
-    <textarea class="comment" name="text" cols="40" rows="10" placeholder="<%= t('javascripts.notes.new.advice') %>"></textarea>
+    <textarea class="comment" name="text" cols="40" rows="10" maxlength="2000" placeholder="<%= t('javascripts.notes.new.advice') %>"></textarea>
     <div class="buttons clearfix">
       <input type="submit" name="add" value="<%= t('javascripts.notes.new.add') %>" disabled="1">
     </div>
diff --git a/app/views/browse/note.html.erb b/app/views/browse/note.html.erb
index 53ea0759e..a677a7c14 100644
--- a/app/views/browse/note.html.erb
+++ b/app/views/browse/note.html.erb
@@ -42,7 +42,7 @@
 
   <% if @note.status == "open" %>
     <form action="#">
-      <textarea class="comment" name="text" cols="40" rows="5"></textarea>
+      <textarea class="comment" name="text" cols="40" rows="5" maxlength="2000"></textarea>
       <div class="buttons clearfix">
         <% if current_user and current_user.moderator? -%>
           <input type="submit" name="hide" value="<%= t('javascripts.notes.show.hide') %>" class="deemphasize" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, 'json') %>">
-- 
2.43.2