[stable1.0] fix: add validation for columnDto

lib/Service/ColumnService.php

@@ -22,6 +22,7 @@
 use OCA\Tables\Helper\UserHelper;
 use OCA\Tables\ResponseDefinitions;
 use OCA\Tables\Service\ValueObject\ViewColumnInformation;
+use OCA\Tables\Validation\ColumnDtoValidator;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Db\MultipleObjectsReturnedException;
 use OCP\IL10N;
@@ -43,6 +44,8 @@ class ColumnService extends SuperService {
 
 	private UserHelper $userHelper;
 
+	private ColumnDtoValidator $columnDtoValidator;
+
 	public function __construct(
 		PermissionsService $permissionsService,
 		LoggerInterface $logger,
@@ -53,6 +56,7 @@ public function __construct(
 		RowService $rowService,
 		IL10N $l,
 		UserHelper $userHelper,
+		ColumnDtoValidator $columnDtoValidator,
 	) {
 		parent::__construct($logger, $userId, $permissionsService);
 		$this->mapper = $mapper;
@@ -61,6 +65,7 @@ public function __construct(
 		$this->rowService = $rowService;
 		$this->l = $l;
 		$this->userHelper = $userHelper;
+		$this->columnDtoValidator = $columnDtoValidator;
 	}
 
 	/**
@@ -181,6 +186,7 @@ public function create(
 		if (ColumnType::tryFrom($columnDto->getType()) === null) {
 			throw new BadRequestError('Column type ' . $columnDto->getType() . ' does not exist.');
 		}
+		$this->columnDtoValidator->validate($columnDto);
 		// security
 		if ($viewId) {
 			try {
@@ -298,6 +304,7 @@ public function update(
 			if (!$this->permissionsService->canUpdateColumnsByTableId($item->getTableId())) {
 				throw new PermissionError('update column id = ' . $columnId . ' is not allowed.');
 			}
+			$this->columnDtoValidator->validate($columnDto);
 
 			if ($columnDto->getTitle() !== null) {
 				$item->setTitle($columnDto->getTitle());

lib/Validation/ColumnDtoValidator.php

@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Tables\Validation;
+
+use OCA\Tables\Dto\Column as ColumnDto;
+use OCA\Tables\Errors\BadRequestError;
+
+class ColumnDtoValidator {
+	/**
+	 * @throws BadRequestError
+	 */
+	public function validate(ColumnDto $columnDto): void {
+		$textMaxLength = $columnDto->getTextMaxLength();
+		if ($textMaxLength !== null && $textMaxLength < -1) {
+			throw new BadRequestError('Maximum text length must be greater than or equal to 0, or -1 for no limit.');
+		}
+
+		$numberMin = $columnDto->getNumberMin();
+		$numberMax = $columnDto->getNumberMax();
+		if ($numberMin !== null && $numberMax !== null && $numberMin > $numberMax) {
+			throw new BadRequestError('Minimum number must be less than or equal to maximum number.');
+		}
+	}
+}