From e4446ae14aed30bd21afdb835172f4fbc446b707 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <barisusakli@gmail.com>
Date: Wed, 15 Feb 2023 22:06:00 -0500
Subject: [PATCH] more sanity checks for bookmark

dont allow setting bookmark higher than topic postcount
---
 public/src/client/topic.js      | 2 +-
 public/src/modules/navigator.js | 2 +-
 src/socket.io/topics.js         | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/src/client/topic.js b/public/src/client/topic.js
index bc0dd13017..411956df03 100644
--- a/public/src/client/topic.js
+++ b/public/src/client/topic.js
@@ -356,7 +356,7 @@ define('forum/topic', [
 			)
 		) {
 			if (app.user.uid) {
-				ajaxify.data.bookmark = index;
+				ajaxify.data.bookmark = Math.min(index, ajaxify.data.postcount);
 
 				socket.emit('topics.bookmark', {
 					tid: ajaxify.data.tid,
diff --git a/public/src/modules/navigator.js b/public/src/modules/navigator.js
index 18a4446548..08d083c1d9 100644
--- a/public/src/modules/navigator.js
+++ b/public/src/modules/navigator.js
@@ -355,7 +355,7 @@ define('navigator', ['forum/pagination', 'components', 'hooks', 'alerts', 'trans
 			return;
 		}
 
-		index = Math.max(index, ajaxify.data.bookmark);
+		index = Math.max(index, Math.min(ajaxify.data.bookmark, ajaxify.data.postcount));
 		const unreadEl = paginationBlockUnreadEl.get(0);
 		const trackEl = unreadEl.parentNode;
 		const trackHeight = trackEl.getBoundingClientRect().height;
diff --git a/src/socket.io/topics.js b/src/socket.io/topics.js
index c07e6410c1..b0a4fd3abc 100644
--- a/src/socket.io/topics.js
+++ b/src/socket.io/topics.js
@@ -35,7 +35,7 @@ SocketTopics.bookmark = async function (socket, data) {
 	const postcount = await topics.getTopicField(data.tid, 'postcount');
 	if (data.index > meta.config.bookmarkThreshold && postcount > meta.config.bookmarkThreshold) {
 		const currentIndex = await db.sortedSetScore(`tid:${data.tid}:bookmarks`, socket.uid);
-		if (!currentIndex || data.index > currentIndex) {
+		if (!currentIndex || (data.index > currentIndex && data.index <= postcount) || (currentIndex > postcount)) {
 			await topics.setUserBookmark(data.tid, socket.uid, data.index);
 		}
 	}