Merge pull request #2835 from nextcloud/backport/2826/stable32

[stable32] fix: enhance validation upon team creation

Author: cristianscheid

lib/Controller/LocalController.php

@@ -37,6 +37,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSException;
 use OCP\AppFramework\OCSController;
@@ -119,6 +120,7 @@ public function __construct(
 
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 10, period: 60)]
 	public function create(string $name, bool $personal = false, bool $local = false): DataResponse {
 		try {
 			if (!$this->configService->isGSAvailable() && $local === true) {

lib/Exceptions/CircleNameTooLongException.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Circles\Exceptions;
+
+class CircleNameTooLongException extends FederatedItemBadRequestException {
+}

lib/FederatedItems/CircleEdit.php

@@ -13,6 +13,7 @@
 
 use OCA\Circles\Db\CircleRequest;
 use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Exceptions\CircleNameTooLongException;
 use OCA\Circles\Exceptions\CircleNameTooShortException;
 use OCA\Circles\Exceptions\RequestBuilderException;
 use OCA\Circles\IFederatedItem;
@@ -70,6 +71,7 @@ public function __construct(
 	 *
 	 * @throws RequestBuilderException
 	 * @throws CircleNameTooShortException
+	 * @throws CircleNameTooLongException
 	 */
 	public function verify(FederatedEvent $event): void {
 		$circle = $event->getCircle();
@@ -84,6 +86,8 @@ public function verify(FederatedEvent $event): void {
 			$new->setName($this->circleService->cleanCircleName($data->g('name')));
 			if (strlen($new->getName()) < 3) {
 				throw new CircleNameTooShortException('Circle name is too short');
+			} elseif (strlen($new->getName()) > 127) {
+				throw new CircleNameTooLongException('Circle name is too long');
 			}
 			$event->getData()->s('name', $new->getName());
 		}

lib/Service/CircleService.php

@@ -14,6 +14,7 @@
 use OCA\Circles\AppInfo\Application;
 use OCA\Circles\Db\CircleRequest;
 use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Exceptions\CircleNameTooLongException;
 use OCA\Circles\Exceptions\CircleNameTooShortException;
 use OCA\Circles\Exceptions\CircleNotFoundException;
 use OCA\Circles\Exceptions\FederatedEventException;
@@ -186,6 +187,8 @@ public function create(
 
 		if (strlen($circle->getName()) < 3) {
 			throw new CircleNameTooShortException('Circle name is too short');
+		} elseif (strlen($circle->getName()) > 127) {
+			throw new CircleNameTooLongException('Circle name is too long');
 		}
 
 		if ($personal) {