Clamp /api/recent HOURS to 1h..7d (abuse guard, Cody)

0631d5f5c40acb21e097f02c2f78a2321bbe7272 · 2026-08-11 08:58:58 -0700 · Steve

Files touched

M recent.py

Diff

commit 0631d5f5c40acb21e097f02c2f78a2321bbe7272
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 11 08:58:58 2026 -0700

    Clamp /api/recent HOURS to 1h..7d (abuse guard, Cody)
---
 recent.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recent.py b/recent.py
index c3c1112..3406b75 100644
--- a/recent.py
+++ b/recent.py
@@ -4,7 +4,7 @@ Used by the server's /api/recent for the Live feed. Token stays server-side."""
 import json, os, re, sys, time, urllib.request, urllib.parse
 
 ENV = os.path.expanduser("~/Projects/secrets-manager/.env")
-HOURS = float(os.environ.get("HOURS", "8"))
+HOURS = max(1.0, min(168.0, float(os.environ.get("HOURS", "8"))))  # clamp 1h..7d (abuse guard)
 BASE = "https://www.zopim.com/api/v2/incremental/chats"

← b6d80b4 SECURITY: bind app to 127.0.0.1 (localhost-only) so nginx Ba · back to Zendesk Chat Analyzer · Add CSV export of current filtered/arranged grid view (clien 590979c →