From adc31bfa1d08a8237cde647a53a196d73bfe1aea Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 18 Feb 2025 09:22:54 +0000
Subject: [PATCH] apply security patch: release-11.0.11/322-202502130521.patch

commit 67551d73c27e98bbe1e85146c86a3a7f0260168f
Author: AgnesToulet <35176601+AgnesToulet@users.noreply.github.com>
Date:   Tue Feb 11 10:57:05 2025 +0100

    Dashboards: Prevent title longer than 5 000 characters

    (cherry picked from commit f9e0789210004b0bd7902255644ef348ae7b3aa8)
---
 pkg/services/dashboards/errors.go                    | 5 +++++
 pkg/services/dashboards/service/dashboard_service.go | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/pkg/services/dashboards/errors.go b/pkg/services/dashboards/errors.go
index 307f18fc50e..b8289dfbbc7 100644
--- a/pkg/services/dashboards/errors.go
+++ b/pkg/services/dashboards/errors.go
@@ -46,6 +46,11 @@ var (
 		StatusCode: 400,
 		Status:     "empty-name",
 	}
+	ErrDashboardTitleTooLong = DashboardErr{
+		Reason:     "Dashboard title cannot contain more than 5 000 characters",
+		StatusCode: 400,
+		Status:     "title-too-long",
+	}
 	ErrDashboardFolderCannotHaveParent = DashboardErr{
 		Reason:     "A Dashboard Folder cannot be added to another folder",
 		StatusCode: 400,
diff --git a/pkg/services/dashboards/service/dashboard_service.go b/pkg/services/dashboards/service/dashboard_service.go
index b21b3472d90..e8acab16a0d 100644
--- a/pkg/services/dashboards/service/dashboard_service.go
+++ b/pkg/services/dashboards/service/dashboard_service.go
@@ -112,6 +112,10 @@ func (dr *DashboardServiceImpl) BuildSaveDashboardCommand(ctx context.Context, d
 		return nil, dashboards.ErrDashboardTitleEmpty
 	}
 
+	if len(dash.Title) > 5000 {
+		return nil, dashboards.ErrDashboardTitleTooLong
+	}
+
 	metrics.MFolderIDsServiceCount.WithLabelValues(metrics.Dashboard).Inc()
 	// nolint:staticcheck
 	if dash.IsFolder && dash.FolderID > 0 {