nextcloud/server · error · Sabre\DAV\Exception\BadRequest

Message exceeds allowed character limit of 1000

Error message

Message exceeds allowed character limit of 1000

What it means

Comments are capped at IComment::MAX_MESSAGE_LENGTH, which is 1000 characters. Comment::setMessage() throws MessageTooLongException for longer strings, and the DAV plugin converts it into a 400 response that names the limit. The limit applies to the decoded message string, not to the raw request size.

Source

Thrown at apps/dav/lib/Comments/CommentsPlugin.php:233

			if (!is_null($user)) {
				$actorId = $user->getUID();
			}
		}
		if (is_null($actorId)) {
			throw new BadRequest('Invalid actor "' . $actorType . '"');
		}

		try {
			$comment = $this->commentsManager->create($actorType, $actorId, $objectType, $objectId);
			$comment->setMessage($data['message']);
			$comment->setVerb($data['verb']);
			$this->commentsManager->save($comment);
			return $comment;
		} catch (\InvalidArgumentException $e) {
			throw new BadRequest('Invalid input values', 0, $e);
		} catch (MessageTooLongException $e) {
			$msg = 'Message exceeds allowed character limit of ';
			throw new BadRequest($msg . IComment::MAX_MESSAGE_LENGTH, 0, $e);
		}
	}
}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Validate and cap the message to 1000 characters client-side before sending.
2. Split longer content into multiple comments, or store the long text elsewhere and post a short comment linking to it.
3. Use mb_strlen($message, 'UTF-8') so the client count matches the server's character-based count.

Example fix

// before: HTTP 400 Message exceeds allowed character limit of 1000
$payload['message'] = $userText;

// after: cap at the server limit, counted in characters
$max = 1000; // IComment::MAX_MESSAGE_LENGTH
$payload['message'] = mb_strlen($userText, 'UTF-8') > $max
    ? mb_substr($userText, 0, $max, 'UTF-8')
    : $userText;

$max = 1000; // IComment::MAX_MESSAGE_LENGTH
if (mb_strlen($payload['message'], 'UTF-8') > $max) {
    $payload['message'] = mb_substr($payload['message'], 0, $max, 'UTF-8');
    // or reject: throw new MessageTooLongClientError();
}

try {
    $client->request('POST', $commentsUrl, $body);
} catch (ClientHttpException $e) {
    if ($e->getResponse()->getStatusCode() === 400
        && str_contains($e->getResponse()->getBody()->getContents(), 'character limit')) {
        $payload['message'] = mb_substr($payload['message'], 0, 1000, 'UTF-8');
        $client->request('POST', $commentsUrl, json_encode($payload));
    }
}

When it happens

Trigger: POST (create) or PUT (edit) of a comment whose message field exceeds 1000 characters after JSON decoding; multi-byte text is measured in characters, not bytes.

Common situations: Pasting long text into comment UIs; clients that count bytes instead of characters on UTF-8 content and therefore underestimate the length; concatenating templated messages client-side without a cap.

Related errors

• Message exceeds allowed character limit of 1000
• Invalid input values
• URI too long. Address book not created
• Only authors are allowed to edit their comment.
• Invalid actor "$actorType"

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/bb22c1292687780f. Report an issue: GitHub.