invalid-idle-time-limit-value: invalid default value of 0.9 for all users

Description:

After upgrading Rocket.Chat to 0.66.0, all my users have an "Idle Time Limit" value of 0.9.

I first thought this was an integer issue (requiring you to input an integer instead of non-integers like 0.9). After fiddling a bit, it turns out that you cannot even input a value of 10 as it also says it's invalid.

It seems like invalid-idle-time-limit-value is checked against invalid-idle-time-limit-value / 60. Every value that is >= 60 seems to be valid (meaning a minute-value of 1 or bigger).

In addition to that, the input field blocks me from entering , in Chromium (but doesn't prevent me to do so in Firefox). If I save the value and it's bigger than 60 and contains a dot (e.g. 60,2), the value after the decimal sign (either . or ,) is cut off and the remaining integer is used.

Also the page reloads, after saving the value.

Main take-aways are for me:

• Do not do client-side prevention of entering characters you don't want. This is not limited to the UI we're talking about, you're doing similar stuff all around the UI! Do server-side checking! Otherwise you always have to write the client-side check in the UI and again on the server to verify that you client-side check worked (or to prevent somebody from injecting chars you don't want)

Steps to reproduce:

1. Go to your profile
2. See, that the default value is 0.9 (invalid and doesn't make sense as a default value)
3. Set the value to 30 and try to save (invalid)
4. Set the value to 60 and try to save (valid)
5. Set the value to 60,2 (Firefox) or 60.2 (Chromium) and try to save (value is cut off after . or , and saved)

Expected behavior:

• good default value (maybe 600 seconds?)

Actual behavior:

• see Steps to reproduce

Server Setup Information:

• Version of Rocket.Chat Server: 0.66.0
• Operating System: Oracle Linux 7.5
• Deployment Method: tar (via Ansible)
• Number of Running Instances: 1
• DB Replicaset Oplog: disabled
• NodeJS Version: 8.11.3
• MongoDB Version: 2.6.12

Additional context

Relevant logs:

Start by reproducing the Idle Time Limit behavior from the profile settings using the listed values and browser differences. Trace the profile setting's client-side input handling and server-side validation, then verify that valid minute values, decimal input, the default value, and saving behavior match the issue's expected behavior.