diff --git a/src/Umbraco.Core/Models/Rdbms/AuditEntryDto.cs b/src/Umbraco.Core/Models/Rdbms/AuditEntryDto.cs index ae9010dc24..d2131ee0ae 100644 --- a/src/Umbraco.Core/Models/Rdbms/AuditEntryDto.cs +++ b/src/Umbraco.Core/Models/Rdbms/AuditEntryDto.cs @@ -11,6 +11,9 @@ namespace Umbraco.Core.Models.Rdbms internal class AuditEntryDto { public const string TableName = "umbracoAudit"; + public const int IpLength = 64; + public const int EventTypeLength = 256; + public const int DetailsLength = 1024; [Column("id")] [PrimaryKeyColumn] @@ -25,12 +28,12 @@ namespace Umbraco.Core.Models.Rdbms [Column("performingDetails")] [NullSetting(NullSetting = NullSettings.Null)] - [Length(1024)] + [Length(DetailsLength)] public string PerformingDetails { get; set; } [Column("performingIp")] [NullSetting(NullSetting = NullSettings.Null)] - [Length(64)] + [Length(IpLength)] public string PerformingIp { get; set; } [Column("eventDate")] @@ -42,16 +45,16 @@ namespace Umbraco.Core.Models.Rdbms [Column("affectedDetails")] [NullSetting(NullSetting = NullSettings.Null)] - [Length(1024)] + [Length(DetailsLength)] public string AffectedDetails { get; set; } [Column("eventType")] - [Length(256)] + [Length(EventTypeLength)] public string EventType { get; set; } [Column("eventDetails")] [NullSetting(NullSetting = NullSettings.Null)] - [Length(1024)] + [Length(DetailsLength)] public string EventDetails { get; set; } } } diff --git a/src/Umbraco.Core/Services/AuditService.cs b/src/Umbraco.Core/Services/AuditService.cs index 82cec0385b..64be2a4152 100644 --- a/src/Umbraco.Core/Services/AuditService.cs +++ b/src/Umbraco.Core/Services/AuditService.cs @@ -4,6 +4,7 @@ using System.Linq; using Umbraco.Core.Events; using Umbraco.Core.Logging; using Umbraco.Core.Models; +using Umbraco.Core.Models.Rdbms; using Umbraco.Core.Persistence; using Umbraco.Core.Persistence.DatabaseModelDefinitions; using Umbraco.Core.Persistence.Querying; @@ -121,13 +122,17 @@ namespace Umbraco.Core.Services if (string.IsNullOrWhiteSpace(eventDetails)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(eventDetails)); //we need to truncate the data else we'll get SQL errors - affectedDetails = affectedDetails?.Substring(0, Math.Min(affectedDetails.Length, 1024)); - eventDetails = eventDetails.Substring(0, Math.Min(eventDetails.Length, 1024)); + affectedDetails = affectedDetails?.Substring(0, Math.Min(affectedDetails.Length, AuditEntryDto.DetailsLength)); + eventDetails = eventDetails.Substring(0, Math.Min(eventDetails.Length, AuditEntryDto.DetailsLength)); //validate the eventType - must contain a forward slash, no spaces, no special chars var eventTypeParts = eventType.ToCharArray(); if (eventTypeParts.Contains('/') == false || eventTypeParts.All(c => char.IsLetterOrDigit(c) || c == '/' || c == '-') == false) throw new ArgumentException(nameof(eventType) + " must contain only alphanumeric characters, hyphens and at least one '/' defining a category"); + if (eventType.Length > AuditEntryDto.EventTypeLength) + throw new ArgumentException($"Must be max {AuditEntryDto.EventTypeLength} chars.", nameof(eventType)); + if (performingIp.Length > AuditEntryDto.IpLength) + throw new ArgumentException($"Must be max {AuditEntryDto.EventTypeLength} chars.", nameof(performingIp)); var entry = new AuditEntry {