From b6821f7830527a2f10d3de9f8cd848a7b2ed83da Mon Sep 17 00:00:00 2001
From: Cristian Scheid <cristianscheid@gmail.com>
Date: Wed, 26 Aug 2026 15:58:05 -0300
Subject: [PATCH] fix: enhance validation upon team creation

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>
---
 lib/Controller/LocalController.php            |  2 ++
 lib/Exceptions/CircleNameTooLongException.php | 13 +++++++++++++
 lib/FederatedItems/CircleEdit.php             |  4 ++++
 lib/Service/CircleService.php                 |  3 +++
 4 files changed, 22 insertions(+)
 create mode 100644 lib/Exceptions/CircleNameTooLongException.php

diff --git a/lib/Controller/LocalController.php b/lib/Controller/LocalController.php
index 72d309af5..92d890ed9 100644
--- a/lib/Controller/LocalController.php
+++ b/lib/Controller/LocalController.php
@@ -37,6 +37,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSException;
 use OCP\AppFramework\OCSController;
@@ -119,6 +120,7 @@ public function __construct(
 
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 10, period: 60)]
 	public function create(string $name, bool $personal = false, bool $local = false): DataResponse {
 		try {
 			if (!$this->configService->isGSAvailable() && $local === true) {
diff --git a/lib/Exceptions/CircleNameTooLongException.php b/lib/Exceptions/CircleNameTooLongException.php
new file mode 100644
index 000000000..08dead79f
--- /dev/null
+++ b/lib/Exceptions/CircleNameTooLongException.php
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Circles\Exceptions;
+
+class CircleNameTooLongException extends FederatedItemBadRequestException {
+}
diff --git a/lib/FederatedItems/CircleEdit.php b/lib/FederatedItems/CircleEdit.php
index db84c204d..91fa38bf8 100644
--- a/lib/FederatedItems/CircleEdit.php
+++ b/lib/FederatedItems/CircleEdit.php
@@ -13,6 +13,7 @@
 
 use OCA\Circles\Db\CircleRequest;
 use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Exceptions\CircleNameTooLongException;
 use OCA\Circles\Exceptions\CircleNameTooShortException;
 use OCA\Circles\Exceptions\RequestBuilderException;
 use OCA\Circles\IFederatedItem;
@@ -70,6 +71,7 @@ public function __construct(
 	 *
 	 * @throws RequestBuilderException
 	 * @throws CircleNameTooShortException
+	 * @throws CircleNameTooLongException
 	 */
 	public function verify(FederatedEvent $event): void {
 		$circle = $event->getCircle();
@@ -84,6 +86,8 @@ public function verify(FederatedEvent $event): void {
 			$new->setName($this->circleService->cleanCircleName($data->g('name')));
 			if (strlen($new->getName()) < 3) {
 				throw new CircleNameTooShortException('Circle name is too short');
+			} elseif (strlen($new->getName()) > 127) {
+				throw new CircleNameTooLongException('Circle name is too long');
 			}
 			$event->getData()->s('name', $new->getName());
 		}
diff --git a/lib/Service/CircleService.php b/lib/Service/CircleService.php
index 51d1f79ff..0ab3ba094 100644
--- a/lib/Service/CircleService.php
+++ b/lib/Service/CircleService.php
@@ -14,6 +14,7 @@
 use OCA\Circles\AppInfo\Application;
 use OCA\Circles\Db\CircleRequest;
 use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Exceptions\CircleNameTooLongException;
 use OCA\Circles\Exceptions\CircleNameTooShortException;
 use OCA\Circles\Exceptions\CircleNotFoundException;
 use OCA\Circles\Exceptions\FederatedEventException;
@@ -186,6 +187,8 @@ public function create(
 
 		if (strlen($circle->getName()) < 3) {
 			throw new CircleNameTooShortException('Circle name is too short');
+		} elseif (strlen($circle->getName()) > 127) {
+			throw new CircleNameTooLongException('Circle name is too long');
 		}
 
 		if ($personal) {