Skip to content

fix: validate length of displayname when setting it #41172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
phil-davis merged 1 commit into from
Feb 1, 2024
Merged

fix: validate length of displayname when setting it #41172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions changelog/unreleased/41172
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Bugfix: input validation when setting the displayname of a user or self

https://github.com/owncloud/core/pull/41172
7 changes: 6 additions & 1 deletion settings/Controller/UsersController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1071,6 +1071,11 @@ public function stats() {
* @return DataResponse
*/
public function setDisplayName($username, $displayName) {
$resp = $this->validateString($displayName, 64);
if ($resp) {
return $resp;
}
Comment on lines +1074 to +1077
Copy link
Member

@jvillafanez jvillafanez Feb 1, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should refactor the validation at some point.
I see 2 options for the validateString (and validateEmail) methods:

  • Return true or false according to the validation
  • Don't return anything and throw an exception if the validation fails. We might need to include a comment saying that an unhandled exception could be thrown from that method.

Right now, the code feels too unnatural, and I had to check what the validateString method does, which is awkward.

Copy link
Member Author

@DeepDiver1975 DeepDiver1975 Feb 1, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes - we had this already on some other pr.

In an ideal world we would simply throw an exception which is caught by a middle ware ....

But to be honest - oc10 will go nowhere from here ... I just want to harden this one api call 🤷


$currentUser = $this->userSession->getUser();

if ($username === null) {
Expand Down Expand Up @@ -1166,7 +1171,7 @@ public function sendEmail($userId, $mailAddress) {
*
* @param string $id
* @param string $mailAddress
* @return JSONResponse
* @return JSONResponse|DataResponse
*/
public function setEmailAddress($id, $mailAddress) {
$resp = $this->validateEMail($mailAddress);
Expand Down