2 files changed, 16 insertions, 2 deletions
diff --git a/phpBB/includes/ucp/ucp_pm_options.php b/phpBB/includes/ucp/ucp_pm_options.php
index bde5d1dfcf..bf7334b307 100644
--- a/phpBB/includes/ucp/ucp_pm_options.php
+++ b/phpBB/includes/ucp/ucp_pm_options.php
@@ -327,10 +327,23 @@ function message_options($id, $mode, $global_privmsgs_rules, $global_rule_condit
 				trigger_error('RULE_ALREADY_DEFINED');
 			}
 
+			// Prevent users from flooding the rules table
+			$sql = 'SELECT COUNT(rule_id) AS num_rules
+				FROM ' . PRIVMSGS_RULES_TABLE . '
+				WHERE user_id = ' . (int) $user->data['user_id'];
+			$result = $db->sql_query($sql);
+			$num_rules = (int) $db->sql_fetchfield('num_rules');
+			$db->sql_freeresult($result);
+
+			if ($num_rules >= 5000)
+			{
+				trigger_error('RULE_LIMIT_REACHED');
+			}
+
 			$sql = 'INSERT INTO ' . PRIVMSGS_RULES_TABLE . ' ' . $db->sql_build_array('INSERT', $rule_ary);
 			$db->sql_query($sql);
 
-			// Update users message rules
+			// Set the user_message_rules bit
 			$sql = 'UPDATE ' . USERS_TABLE . '
 				SET user_message_rules = 1
 				WHERE user_id = ' . $user->data['user_id'];
@@ -377,7 +390,7 @@ function message_options($id, $mode, $global_privmsgs_rules, $global_rule_condit
 			$row = $db->sql_fetchrow($result);
 			$db->sql_freeresult($result);
 
-			// Update users message rules
+			// Unset the user_message_rules bit
 			if (!$row)
 			{
 				$sql = 'UPDATE ' . USERS_TABLE . '
diff --git a/phpBB/language/en/ucp.php b/phpBB/language/en/ucp.php
index 2d9cf46213..e3971c75e2 100644
--- a/phpBB/language/en/ucp.php
+++ b/phpBB/language/en/ucp.php
@@ -404,6 +404,7 @@ $lang = array_merge($lang, array(
 	'RULE_ADDED'						=> 'Rule successfully added.',
 	'RULE_ALREADY_DEFINED'				=> 'This rule was defined previously.',
 	'RULE_DELETED'						=> 'Rule successfully removed.',
+	'RULE_LIMIT_REACHED'				=> 'You cannot add more PM rules. You have reached the maximum number of rules.',
 	'RULE_NOT_DEFINED'					=> 'Rule not correctly specified.',
 	'RULE_REMOVED_MESSAGES'				=> array(
 		1	=> '%d private message was removed due to private message filters.',