Prevent reserved field name when adding a field via form

[Jun Omae]

Trac ignores reserved names in custom fields.

2017-06-22 19:53:07,790 (7fe956e49700) WARNING: Field name "group" is a reserved name (ignoring)

We could validate a field name is not listed in TicketSystem.reserved_field_names. The reserved_field_names property is available since ​Trac-0.11.3 (introduced in ​trac:r7769).

At ​trac:source:/tags/trac-1.0.15/trac/ticket/api.py@:352-354,365-367#L347]:

352             if field['name'] in self.reserved_field_names:
353                 self.log.warning('Field name "%s" is a reserved name '
354                                  '(ignoring)', field['name'])
355                 continue
...
365     reserved_field_names = ['report', 'order', 'desc', 'group', 'groupdesc',
366                             'col', 'row', 'format', 'max', 'page', 'verbose',
367                             'comment', 'or']

customfieldadminplugin/0.11/customfieldadmin/api.py

@@ -100 +100 @@
             raise TracError(_("Only alphanumeric characters allowed for " \
                              "custom field name ('a-z' or '0-9' or '_'), " \
                              "with 'a-z' as first character."))
+        tktsys = TicketSystem(self.env)
+        if cfield['name'] in tktsys.reserved_field_names:
+            raise TracError(_("Field name is reserved"))
         # Name must begin with a character - anything else not supported by Trac
         if not cfield['name'][0].isalpha():
             raise TracError(
@@ -113 +116 @@
         # (if modify it should already be deleted)
         if create and self.config.get('ticket-custom', cfield['name']):
             raise TracError(_("Can not create as field already exists."))
-        if create and [f for f in TicketSystem(self.env).fields
+        if create and [f for f in tktsys.fields
                        if f['name'] == cfield['name']]:
                 raise TracError(_("Can't create a custom field with the "
                                   "same name as a built-in field."))

[Ryan J Ollos]

In 16676:

TracCustomFieldAdmin 0.2.13: Prevent using reserved field name

Patch by Jun Omae.

Fixes #13220.

[Ryan J Ollos]

I'll also incorporate into the branch I'm preparing for ​trac:#11469.

[Jun Omae]

In 16677:

TracCustomFieldAdmin 0.2.13: follow up to [16676], fix reserved names check being case-sensitive and add unit tests for reserved field names (refs #13220)