From 28df047d92d5b428e2cb6f6f7cbe123043007f50 Mon Sep 17 00:00:00 2001
From: Claudio Costa <cstcld91@gmail.com>
Date: Thu, 25 Mar 2021 11:38:43 +0100
Subject: [PATCH] Prevent User.Timezone field to overflow DB column capacity
 (#17220)

---
 api4/user_test.go | 10 ++++++++++
 i18n/en.json      |  4 ++++
 model/user.go     |  9 +++++++++
 3 files changed, 23 insertions(+)

diff --git a/api4/user_test.go b/api4/user_test.go
index c44fb496ec..c9f3ba7dc6 100644
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -1693,6 +1693,16 @@ func TestPatchUser(t *testing.T) {
 	user := th.CreateUser()
 	th.Client.Login(user.Email, user.Password)
 
+	t.Run("Timezone limit error", func(t *testing.T) {
+		patch := &model.UserPatch{}
+		patch.Timezone = model.StringMap{}
+		patch.Timezone["manualTimezone"] = string(make([]byte, model.USER_TIMEZONE_MAX_RUNES))
+		ruser, resp := th.Client.PatchUser(user.Id, patch)
+		CheckBadRequestStatus(t, resp)
+		require.Equal(t, "model.user.is_valid.timezone_limit.app_error", resp.Error.Id)
+		require.Nil(t, ruser)
+	})
+
 	patch := &model.UserPatch{}
 	patch.Password = model.NewString("testpassword")
 	patch.Nickname = model.NewString("Joram Wilander")
diff --git a/i18n/en.json b/i18n/en.json
index 20e7b4fe77..66232c579f 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -8398,6 +8398,10 @@
     "id": "model.user.is_valid.locale.app_error",
     "translation": "Invalid locale."
   },
+  {
+    "id": "model.user.is_valid.marshal.app_error",
+    "translation": "Failed to encode field to JSON"
+  },
   {
     "id": "model.user.is_valid.nickname.app_error",
     "translation": "Invalid nickname."
diff --git a/model/user.go b/model/user.go
index 0723e35f64..6d7bcf509f 100644
--- a/model/user.go
+++ b/model/user.go
@@ -56,6 +56,7 @@ const (
 	USER_NAME_MIN_LENGTH      = 1
 	USER_PASSWORD_MAX_LENGTH  = 72
 	USER_LOCALE_MAX_LENGTH    = 5
+	USER_TIMEZONE_MAX_RUNES   = 256
 )
 
 //msgp:tuple User
@@ -312,6 +313,14 @@ func (u *User) IsValid() *AppError {
 		return InvalidUserError("locale", u.Id)
 	}
 
+	if len(u.Timezone) > 0 {
+		if tzJSON, err := json.Marshal(u.Timezone); err != nil {
+			return NewAppError("User.IsValid", "model.user.is_valid.marshal.app_error", nil, err.Error(), http.StatusInternalServerError)
+		} else if utf8.RuneCount(tzJSON) > USER_TIMEZONE_MAX_RUNES {
+			return InvalidUserError("timezone_limit", u.Id)
+		}
+	}
+
 	return nil
 }