# SiteSetting numbers not properly validated
**URL:** https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026
**Category:** Bug
**Created:** [February 9, 2015, 5:58pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026 "2015-02-09T17:58:51Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@rcfox](https://meta.discourse.org/u/rcfox)
#### Post date: [February 9, 2015, 5:58pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/1 "2015-02-09T17:58:51Z")
Entering a large value for some values in the admin settings can cause the settings dashboard to 500 upon reload. As an example, setting embed\_post\_limit to 999999999999999999999999999999999999999999999999999999999 will be successful, but breaks the settings page.
I was able to set it back to a non-broken value from the Rails repl, but I suspect most people won’t know how to do that.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 9, 2015, 11:28pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/2 "2015-02-09T23:28:56Z")
We should probably add some kind of default integer validation for site settings.
Still, it’s hard to read this as anything other than “when you do something dumb, something dumb happens” 😉
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [February 9, 2015, 11:32pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/3 "2015-02-09T23:32:40Z")
> [@codinghorror](#):
>
> Still, it’s hard to read this as anything other than “when you do something dumb, something dumb happens”
Depends. Sure he used an extreme example, but what if he entered 574 and it did it? Or 1000? Or 10000? At one point does it become “something dumb”?
I’m actually a bit surprised this hasn’t come up yet. Even with all of the playing around I’ve done with Discourse…
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [February 9, 2015, 11:47pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/4 "2015-02-09T23:47:37Z")
Assuming the value is a Postgre Int (signed 4 bytes) - negative values not used - the possible max value is
2,147,483,648 (if my maths serves me correctly)
Even if
999999999999999999999999999999999999999999999999999999999
was an overly extreme example it seems to me that accepting over 2 Billion is a more than generous
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 9, 2015, 11:49pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/5 "2015-02-09T23:49:11Z")
Well, if you know programming at all, it’d likely be near 231.
Basically -2,147,483,648 to 2,147,483,647 so.. pretty far outside the realm of normal.
Looks like Ruby does other magic here…
>
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [February 9, 2015, 11:53pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/6 "2015-02-09T23:53:44Z")
Oh I do. And I know the the max storage of an int, but that didn’t mean it was stored that way… 😄
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [February 9, 2015, 11:53pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/7 "2015-02-09T23:53:53Z")
> [@codinghorror](#):
>
> Looks like Ruby does other magic here..
That could explain the 500 errors. No telling what would happen. INSERT / UPDATE query FAIL, loss of data integrity, Clash of the Titans?
I guess one could argue that input validation should happen. Though it doesn’t seem it should be needed for Admins that should know better.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [February 10, 2015, 12:33am UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/8 "2015-02-10T00:33:36Z")
Actually, it’s not that bad.
It breaks here on line 362:
>
It looks like writing and reading the invalid setting to/from PostgreSQL works nicely, but this method just can’t handle a Ruby `Bignum`…
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 6, 2015, 6:22pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/9 "2015-04-06T18:22:41Z")
@techapj this might be a good one for your list. Just fix number validation to start.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [April 23, 2015, 12:52pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/10 "2015-04-23T12:52:01Z")
Okay, added number validation:
[https://github.com/discourse/discourse/pull/3393](https://github.com/discourse/discourse/pull/3393)
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [April 23, 2015, 3:06pm UTC](https://meta.discourse.org/t/sitesetting-numbers-not-properly-validated/25026/11 "2015-04-23T15:06:03Z")