Avoid misuse of the security advisory API endpoint

Author: Seldaek

src/Controller/ApiController.php

@@ -359,6 +359,9 @@ public function securityAdvisoryAction(Request $request, ProviderManager $provid
         if ($updatedSince < 0) {
             return new JsonResponse(['status' => 'error', 'message' => 'Invalid updatedSince parameter: timestamp should not be negative.'], 400);
         }
+        if ($updatedSince > 0 && \count($packageNames) > 0) {
+            return new JsonResponse(['status' => 'error', 'message' => 'Pass only one of "updatedSince" OR "packages" parameters, they cannot be provided together.'], 400);
+        }
 
         $statsd->increment('advisory_api');
 

src/Entity/SecurityAdvisoryRepository.php

@@ -161,7 +161,7 @@ public function searchSecurityAdvisories(array $packageNames, int $updatedSince)
                 .($filterByNames ? ' AND s.packageName IN (:packageNames)' : '')
                 .' ORDER BY '.($filterByNames ? 's.reportedAt DESC, ' : '').'s.id DESC';
 
-            $params = ['updatedSince' => date('Y-m-d H:i:s', $updatedSince)];
+            $params = ['updatedSince' => date('Y-m-d H:i:s', $filterByNames ? 0 : $updatedSince)];
             $types = [];
             if ($filterByNames) {
                 $params['packageNames'] = $packageNames;