MM-13526 Add validation when setting a user's Locale field (#10022)

model/user.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/mattermost/mattermost-server/services/timezones"
 	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/text/language"
 )
 
 const (
@@ -49,6 +50,7 @@ const (
 	USER_NAME_MAX_LENGTH      = 64
 	USER_NAME_MIN_LENGTH      = 1
 	USER_PASSWORD_MAX_LENGTH  = 72
+	USER_LOCALE_MAX_LENGTH    = 5
 )
 
 type User struct {
@@ -172,6 +174,10 @@ func (u *User) IsValid() *AppError {
 		return InvalidUserError("password_limit", u.Id)
 	}
 
+	if !IsValidLocale(u.Locale) {
+		return InvalidUserError("locale", u.Id)
+	}
+
 	return nil
 }
 
@@ -644,3 +650,15 @@ func IsValidEmailBatchingInterval(emailInterval string) bool {
 		emailInterval == PREFERENCE_EMAIL_INTERVAL_FIFTEEN ||
 		emailInterval == PREFERENCE_EMAIL_INTERVAL_HOUR
 }
+
+func IsValidLocale(locale string) bool {
+	if locale != "" {
+		if len(locale) > USER_LOCALE_MAX_LENGTH {
+			return false
+		} else if _, err := language.Parse(locale); err != nil {
+			return false
+		}
+	}
+
+	return true
+}