From e87f77c64061b43186c80ad1b50d313c67d7f6cf Mon Sep 17 00:00:00 2001
From: joebordes <joe@tsolucio.com>
Date: Fri, 2 Jun 2023 18:25:01 +0200
Subject: [PATCH] sec(Documents) sanitize and limit folder name and description

---
 modules/Documents/SaveFolder.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/Documents/SaveFolder.php b/modules/Documents/SaveFolder.php
index b8b072b70c..b14ea98029 100644
--- a/modules/Documents/SaveFolder.php
+++ b/modules/Documents/SaveFolder.php
@@ -15,8 +15,8 @@
 
 $local_log = LoggerManager::getLogger('index');
 $folderid = isset($_REQUEST['record']) ? vtlib_purify($_REQUEST['record']) : '';
-$foldername = utf8RawUrlDecode($_REQUEST['foldername']);
-$folderdesc = utf8RawUrlDecode($_REQUEST['folderdesc']);
+$foldername = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['foldername']))), 0, 20);
+$folderdesc = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['folderdesc']))), 0, 50);
 
 if (isset($_REQUEST['savemode']) && $_REQUEST['savemode'] == 'Save') {
 	if ($folderid == '') {