From 3cd32da9fd52e339ddeade3718fb1e0cda516aac Mon Sep 17 00:00:00 2001 From: Anirudh Oppiliappan Date: Wed, 11 Mar 2026 12:51:42 +0100 Subject: [PATCH] appview/settings: prevent domain claims shorter than 4 chars MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤑📈 Signed-off-by: Anirudh Oppiliappan --- appview/settings/settings.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/appview/settings/settings.go b/appview/settings/settings.go index 1beaa07c..ccdf2af0 100644 --- a/appview/settings/settings.go +++ b/appview/settings/settings.go @@ -118,6 +118,11 @@ func (s *Settings) claimSitesDomain(w http.ResponseWriter, r *http.Request) { return } + if len(subdomain) < 4 { + s.Pages.Notice(w, "settings-sites-error", "Subdomain must be at least 4 characters long.") + return + } + if !isValidSubdomain(subdomain) { s.Pages.Notice(w, "settings-sites-error", "Invalid subdomain. Use only lowercase letters, digits, and hyphens. Cannot start or end with a hyphen.") return -- 2.51.2