From 54255cf923546ad483d6ee399a13f2547e15e0be Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Mon, 16 Dec 2019 16:55:34 +0100
Subject: [PATCH] validate tag name (#1325)

---
 src/API/TimesheetController.php | 2 +-
 src/Entity/Tag.php              | 1 +
 src/Entity/Timesheet.php        | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/API/TimesheetController.php b/src/API/TimesheetController.php
index b55e057a..d949f9b0 100644
--- a/src/API/TimesheetController.php
+++ b/src/API/TimesheetController.php
@@ -125,7 +125,7 @@ class TimesheetController extends BaseApiController
      * @Rest\QueryParam(name="activity", requirements="\d+", strict=true, nullable=true, description="Activity ID to filter timesheets")
      * @Rest\QueryParam(name="page", requirements="\d+", strict=true, nullable=true, description="The page to display, renders a 404 if not found (default: 1)")
      * @Rest\QueryParam(name="size", requirements="\d+", strict=true, nullable=true, description="The amount of entries for each page (default: 50)")
-     * @Rest\QueryParam(name="tags", requirements="[a-zA-Z0-9 \-,]+", strict=true, nullable=true, description="The name of tags which are in the datasets")
+     * @Rest\QueryParam(name="tags", strict=true, nullable=true, description="The name of tags which are in the datasets")
      * @Rest\QueryParam(name="orderBy", requirements="id|begin|end|rate", strict=true, nullable=true, description="The field by which results will be ordered. Allowed values: id, begin, end, rate (default: begin)")
      * @Rest\QueryParam(name="order", requirements="ASC|DESC", strict=true, nullable=true, description="The result order. Allowed values: ASC, DESC (default: DESC)")
      * @Rest\QueryParam(name="begin", requirements=@Constraints\DateTime(format="Y-m-d\TH:i:s"), strict=true, nullable=true, description="Only records after this date will be included (format: HTML5)")
diff --git a/src/Entity/Tag.php b/src/Entity/Tag.php
index 30753764..2add9e9e 100644
--- a/src/Entity/Tag.php
+++ b/src/Entity/Tag.php
@@ -40,6 +40,7 @@ class Tag
      * @ORM\Column(name="name", type="string", length=100, nullable=false)
      * @Assert\NotBlank()
      * @Assert\Length(min=2, max=100)
+     * @Assert\Regex(pattern="/,/",match=false,message="Tag name cannot contain comma")
      */
     private $name;
 
diff --git a/src/Entity/Timesheet.php b/src/Entity/Timesheet.php
index a617c7b6..cb21114c 100644
--- a/src/Entity/Timesheet.php
+++ b/src/Entity/Timesheet.php
@@ -151,6 +151,7 @@ class Timesheet implements EntityWithMetaFields, InvoiceItemInterface
      *      @ORM\JoinColumn(name="tag_id", referencedColumnName="id", onDelete="CASCADE")
      *  }
      * )
+     * @Assert\Valid()
      */
     private $tags;