From c0868f93f1175c32379f6e64b245b724c40478be Mon Sep 17 00:00:00 2001 From: Christopher Ng Date: Tue, 28 Jun 2022 18:03:15 +0000 Subject: [PATCH] Do not save invalid display name to the database Signed-off-by: Christopher Ng --- apps/provisioning_api/lib/Controller/UsersController.php | 4 +++- lib/private/User/Database.php | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/provisioning_api/lib/Controller/UsersController.php b/apps/provisioning_api/lib/Controller/UsersController.php index a26479ba0a8..839ac404c94 100644 --- a/apps/provisioning_api/lib/Controller/UsersController.php +++ b/apps/provisioning_api/lib/Controller/UsersController.php @@ -837,7 +837,9 @@ class UsersController extends AUserData { switch ($key) { case self::USER_FIELD_DISPLAYNAME: case IAccountManager::PROPERTY_DISPLAYNAME: - $targetUser->setDisplayName($value); + if (!$targetUser->setDisplayName($value)) { + throw new OCSException('Invalid displayname', 102); + } break; case self::USER_FIELD_QUOTA: $quota = $value; diff --git a/lib/private/User/Database.php b/lib/private/User/Database.php index 4821a2fc632..fce7551c242 100644 --- a/lib/private/User/Database.php +++ b/lib/private/User/Database.php @@ -215,6 +215,10 @@ class Database extends ABackend implements * Change the display name of a user */ public function setDisplayName(string $uid, string $displayName): bool { + if (mb_strlen($displayName) > 64) { + return false; + } + $this->fixDI(); if ($this->userExists($uid)) { -- 2.39.5