Merge pull request #5591 from Crypt-iQ/rest_sendpayment_fix_07302021

rpcserver: validate FinalCltvDelta and CltvLimit for REST

docs/release-notes/release-notes-0.14.0.md

@@ -150,6 +150,8 @@ A bug has been fixed that would cause `lnd` to [try to bootstrap using the
 currnet DNS seeds when in SigNet
 mode](https://github.com/lightningnetwork/lnd/pull/5564).
 
+[A validation check for sane `CltvLimit` and `FinalCltvDelta` has been added for `REST`-initiated payments.](https://github.com/lightningnetwork/lnd/pull/5591)
+
 ## Documentation 
 
 The [code contribution guidelines have been updated to mention the new

rpcserver.go

@@ -4339,6 +4339,14 @@ func (r *rpcServer) extractPaymentIntent(rpcPayReq *rpcPaymentRequest) (rpcPayme
 			return payIntent, err
 		}
 
+		// Do bounds checking with the block padding.
+		err = routing.ValidateCLTVLimit(
+			payIntent.cltvLimit, payIntent.cltvDelta, true,
+		)
+		if err != nil {
+			return payIntent, err
+		}
+
 		return payIntent, nil
 	}