From ede6d8d36eef26cfa1c010792ece2c0efd5cf94e Mon Sep 17 00:00:00 2001
From: Ruben Carlo Benante <rcb@beco.cc>
Date: Mon, 29 Jun 2026 17:00:01 -0300
Subject: [PATCH] clamp negative inputs to 0 server-side (HTML min="0" is
 client-only)

---
 simuladormobout.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/simuladormobout.php b/simuladormobout.php
index 1c50a9b..eba39c7 100644
--- a/simuladormobout.php
+++ b/simuladormobout.php
@@ -147,7 +147,10 @@ function validar_entrada(){
     $entradas = array();
     foreach ($campos as $campo) {
         if (isset($_POST[$campo]) && $_POST[$campo] !== '') {
-            $entradas[$campo] = (float) limpaPost($_POST[$campo]);
+            // Clampa negativos em 0: nenhum campo legitimo (notas, contagens,
+            // selecoes) e negativo; isto neutraliza POST adulterado, ja que o
+            // min="0" do HTML so vale no navegador.
+            $entradas[$campo] = max(0, (float) limpaPost($_POST[$campo]));
         } else {
             $entradas[$campo] = 0;
         }