diff options
| author | Christoph Wurst <christoph@winzerhof-wurst.at> | 2025-02-28 09:05:05 +0100 |
|---|---|---|
| committer | Christoph Wurst <christoph@winzerhof-wurst.at> | 2025-03-05 13:20:57 +0100 |
| commit | dec37597e484b7735267d6ae54735e0f1055ba54 (patch) | |
| tree | 0667e414d69db505c61e35c1041e5862e0871a30 | |
| parent | 40d5dcbd30f9e80a2185915e4ed103b42af0ec4c (diff) | |
| download | nextcloud-server-backport/51256/stable29.tar.gz nextcloud-server-backport/51256/stable29.zip | |
fix(dav): Handle long absence status earlierbackport/51256/stable29
Validate the request early. Don't let this cause a database error.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
| -rw-r--r-- | apps/dav/lib/Controller/OutOfOfficeController.php | 8 | ||||
| -rw-r--r-- | apps/dav/openapi.json | 5 |
2 files changed, 9 insertions, 4 deletions
diff --git a/apps/dav/lib/Controller/OutOfOfficeController.php b/apps/dav/lib/Controller/OutOfOfficeController.php index 5ab99c34b79..66f89308802 100644 --- a/apps/dav/lib/Controller/OutOfOfficeController.php +++ b/apps/dav/lib/Controller/OutOfOfficeController.php @@ -38,6 +38,7 @@ use OCP\IRequest; use OCP\IUserManager; use OCP\IUserSession; use OCP\User\IAvailabilityCoordinator; +use function mb_strlen; /** * @psalm-import-type DAVOutOfOfficeData from ResponseDefinitions @@ -120,10 +121,10 @@ class OutOfOfficeController extends OCSController { * @param string $lastDay Last day of the absence in format `YYYY-MM-DD` * @param string $status Short text that is set as user status during the absence * @param string $message Longer multiline message that is shown to others during the absence - * @return DataResponse<Http::STATUS_OK, DAVOutOfOfficeData, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'firstDay'}, array{}>|DataResponse<Http::STATUS_UNAUTHORIZED, null, array{}> + * @return DataResponse<Http::STATUS_OK, DAVOutOfOfficeData, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'firstDay'|'statusLength'}, array{}>|DataResponse<Http::STATUS_UNAUTHORIZED, null, array{}> * * 200: Absence data - * 400: When the first day is not before the last day + * 400: When validation fails, e.g. data range error or the first day is not before the last day * 401: When the user is not logged in */ #[NoAdminRequired] @@ -137,6 +138,9 @@ class OutOfOfficeController extends OCSController { if ($user === null) { return new DataResponse(null, Http::STATUS_UNAUTHORIZED); } + if (mb_strlen($status) > 100) { + return new DataResponse(['error' => 'statusLength'], Http::STATUS_BAD_REQUEST); + } $parsedFirstDay = new DateTimeImmutable($firstDay); $parsedLastDay = new DateTimeImmutable($lastDay); diff --git a/apps/dav/openapi.json b/apps/dav/openapi.json index 7a1c33914cc..b4ee296d648 100644 --- a/apps/dav/openapi.json +++ b/apps/dav/openapi.json @@ -624,7 +624,7 @@ } }, "400": { - "description": "When the first day is not before the last day", + "description": "When validation fails, e.g. data range error or the first day is not before the last day", "content": { "application/json": { "schema": { @@ -652,7 +652,8 @@ "error": { "type": "string", "enum": [ - "firstDay" + "firstDay", + "statusLength" ] } } |