From 1d7de7bc5373db496d8bbec3181294041f6394b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come.chilliet@nextcloud.com>
Date: Tue, 17 Mar 2026 17:35:18 +0100
Subject: [PATCH] fix: Only set valid timezone values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
---
 lib/Controller/TimezoneController.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/Controller/TimezoneController.php b/lib/Controller/TimezoneController.php
index c7ee4eab2..8ae5857b4 100644
--- a/lib/Controller/TimezoneController.php
+++ b/lib/Controller/TimezoneController.php
@@ -1,6 +1,7 @@
 <?php
 
 declare(strict_types=1);
+
 /**
  * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: AGPL-3.0-or-later
@@ -17,10 +18,10 @@
 class TimezoneController extends Controller {
 
 	public function __construct(
-		$appName,
+		string $appName,
 		IRequest $request,
 		private readonly IConfig $config,
-		private $userId,
+		private ?string $userId,
 		private readonly ISession $session,
 	) {
 		parent::__construct($appName, $request);
@@ -30,8 +31,12 @@ public function __construct(
 	 * @NoAdminRequired
 	 * @UseSession
 	 * @throws \OCP\PreConditionNotMetException
+	 * @throws \InvalidArgumentException
 	 */
 	public function setTimezone(string $timezone, int $timezoneOffset): JSONResponse {
+		if (!in_array($timezone, \DateTimeZone::listIdentifiers())) {
+			throw new \InvalidArgumentException('Invalid timezone');
+		}
 		$this->config->setUserValue($this->userId, 'core', 'timezone', $timezone);
 		$this->session->set('timezone', $timezoneOffset);