From 8a8c05b91ecf76de1fa52ad39ee443bd3e1318ee Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 14 Feb 2025 15:52:33 +0000
Subject: [PATCH] apply security patch: release-11.3.4/319-202502130515.patch

commit 9de43df1c61f41336a3fecffbc72c84b38772957
Author: AgnesToulet <35176601+AgnesToulet@users.noreply.github.com>
Date:   Tue Feb 11 10:57:05 2025 +0100

    Dashboards: Prevent title longer than 5 000 characters

    (cherry picked from commit f9e0789210004b0bd7902255644ef348ae7b3aa8)
---
 pkg/services/dashboards/errors.go                    | 5 +++++
 pkg/services/dashboards/service/dashboard_service.go | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/pkg/services/dashboards/errors.go b/pkg/services/dashboards/errors.go
index 0dafc5aebc0..945849c8027 100644
--- a/pkg/services/dashboards/errors.go
+++ b/pkg/services/dashboards/errors.go
@@ -47,6 +47,11 @@ var (
 		StatusCode: 400,
 		Status:     "empty-name",
 	}
+	ErrDashboardTitleTooLong = DashboardErr{
+		Reason:     "Dashboard title cannot contain more than 5 000 characters",
+		StatusCode: 400,
+		Status:     "title-too-long",
+	}
 	ErrDashboardFolderCannotHaveParent = DashboardErr{
 		Reason:     "A Dashboard Folder cannot be added to another folder",
 		StatusCode: 400,
diff --git a/pkg/services/dashboards/service/dashboard_service.go b/pkg/services/dashboards/service/dashboard_service.go
index 168400e5b95..319786adc52 100644
--- a/pkg/services/dashboards/service/dashboard_service.go
+++ b/pkg/services/dashboards/service/dashboard_service.go
@@ -121,6 +121,10 @@ func (dr *DashboardServiceImpl) BuildSaveDashboardCommand(ctx context.Context, d
 		return nil, dashboards.ErrDashboardTitleEmpty
 	}
 
+	if len(dash.Title) > 5000 {
+		return nil, dashboards.ErrDashboardTitleTooLong
+	}
+	
 	metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Dashboard).Inc()
 	// nolint:staticcheck
 	if dash.IsFolder && dash.FolderID > 0 {