# Тысячный разделитель беззвучно портит введенное значение в настройках

**URL:** <https://meta.discourse.org/t/thousand-separator-silently-ruins-inputted-value-in-settings/279977>\
**Category:** Bug\
**Tags:** fixed\
**Created:** [25.Сентябрь.2023 10:33:41 UTC](https://meta.discourse.org/t/thousand-separator-silently-ruins-inputted-value-in-settings/279977 "2023-09-25T10:33:41Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![ted](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ted/32/283882_2.png) [@ted](https://meta.discourse.org/u/ted)\
**Post date:** [10.Октябрь.2023 15:49:05 UTC](https://meta.discourse.org/t/thousand-separator-silently-ruins-inputted-value-in-settings/279977/6 "2023-10-10T15:49:05Z")

</div>

Спасибо за отчёт, @RGJ! 🙏

Это действительно пугающая ситуация. Мы исправили это здесь, во-первых, разрешив в интерфейсе только числовой ввод, а во-вторых, удалив все символы, кроме цифр, на стороне сервера для дополнительной безопасности.

> <https://github.com/discourse/discourse/pull/23816>
>
> \### What is this change?
> 
> Currently, if you set an integer site setting in the… admin interface and include thousands separators, you will silently configure the wrong value.
> 
> \*\*Example:\*\*
> 
> \`\`\`
> 1,000 == 1
> 1.000 == 1
> 1 000 == 1
> \`\`\`
> 
> This PR replaces \`TextField\` inputs for integer site settings with \`NumberField\`.
> 
> It also cleans the numeric input of any non-digits in the backend in case any separators make it through.
> 
> \### Not in this PR
> 
> \- The actual value that is set in the back-end is not sent back to the front-end. We probably should.
> \- We should probably change the latter to use \[native number input\](https://caniuse.com/input-number) in a separate PR.
> \- The \`SiteSettingsController#update\` method is pretty big. I'm considering extracting the logic into a Ruby object that can be tested in isolation, but not in this PR.

---

_[View the full topic](https://meta.discourse.org/t/thousand-separator-silently-ruins-inputted-value-in-settings/279977)._