Modify

Opened 4 years ago

Closed 4 years ago

Last modified 4 years ago

#7575 closed defect (duplicate)

Supplying username allows \r in name

Reported by: anonymous Owned by: pacopablo
Priority: normal Component: AccountManagerPlugin
Severity: normal Keywords: user register name check
Cc: Trac Release: 0.11

Description

I constantly get users in the database which have been created by spammers. It is impossible to delete these, when they have a \r in the username, as all WEB-interface fail to handle these correctly. Creating such users should be prevented.

Attachments (0)

Change History (3)

comment:1 Changed 4 years ago by hasienda

  • Keywords user register name check added
  • Resolution set to duplicate
  • Status changed from new to closed

The proposed patch for #5295 allows for white-listing arbitrary usernames by admin-supplied regexp.

Certainly there are applications, that could still allow \r in usernames, so we shouldn't hard-code a solution for this issue anyway. Previously I tended to not implement the regexp extension introduced by a patch to the aforementioned ticket, but now this is a valid use case.

I have still to think about a meaningful error message, since reporting a regexp to the average user in cleartext, as was suggested, looks definitely flawed to me.

Anyway, we'll stick to the pre-existing proposal.

comment:2 follow-up: Changed 4 years ago by anonymous

Well, when the "\r" in user name is supported, then the remaining functions also need to support it - namely the delete user function :-)

comment:3 in reply to: ↑ 2 Changed 4 years ago by hasienda

Replying to anonymous:

Well, when the "\r" in user name is supported, then the remaining functions also need to support it - namely the delete user function :-)

Good point, one more to think it twice again. Admittedly I've not thought much about that lately.

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.