From a8fd1b38b7e3745c87b72b6b304f26828812caa2 Mon Sep 17 00:00:00 2001
From: Petr Sloup <slouppetr@gmail.com>
Date: Thu, 25 Aug 2016 11:08:19 +0200
Subject: [PATCH] Return 404 for negative zoom levels on static endpoint

---
 src/serve_rendered.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/serve_rendered.js b/src/serve_rendered.js
index 832c303..3d617ce 100644
--- a/src/serve_rendered.js
+++ b/src/serve_rendered.js
@@ -462,6 +462,10 @@ module.exports = function(options, repo, params, id, dataResolver) {
         scale = getScale(req.params.scale),
         format = req.params.format;
 
+    if (z < 0) {
+      return res.status(404).send('Invalid zoom');
+    }
+
     var path = extractPathFromQuery(req.query);
     var overlay = renderOverlay(z, x, y, bearing, pitch, w, h, scale,
                                 path, req.query);