Merge pull request from GHSA-r7h4-76f7-6264

* Actually use maxUsername config value.

* Change maxUsername default to discord.com default

1 files changed, 10 insertions, 0 deletions

diff --git a/src/api/routes/users/@me/index.ts b/src/api/routes/users/@me/index.ts

index 0d3c3135..30091344 100644
--- a/src/api/routes/users/@me/index.ts
+++ b/src/api/routes/users/@me/index.ts
@@ -129,6 +129,16 @@ router.patch(
 					},
 				});
 			}
+
+			const { maxUsername } = Config.get().limits.user;
+			if (check_username.length > maxUsername) {
+				throw FieldErrors({
+					username: {
+						code: "USERNAME_INVALID",
+						message: `Username must be less than ${maxUsername} in length`,
+					},
+				});
+			}
 		}
 
 		if (body.discriminator) {