Log in with username/password: lyceum/lyceum

Ticket #904 (new defect)

Opened 10 months ago

Last modified 4 months ago

validate_username regular expression bug

Reported by: lyceum Assigned to:
Priority: normal Milestone: 1.1
Keywords: Cc: lyceum@asheesh.org

Description (Last modified by jjb)

It has

if(!preg_match('/[\w_-]*$/',$username)) // check that username is alphanumeric

that's bad (no circumflex accent, it spoils this wiki formatting)

  1. the '-' is a special meaning for character class, therefore it's better to use \-
  2. many enterprise installations use login names in Active Directory that contain dots, like 'bill.gates'. Therefore ldap integration requires that dots have to be allowed.

Change History

03/10/08 05:12:27 changed by jjb

  • description changed.
  • milestone set to 1.0.3.

03/10/08 05:12:43 changed by jjb

  • description changed.

03/10/08 05:16:00 changed by jjb

  • cc set to lyceum@asheesh.org.

What does "circumflex accent" mean?

03/11/08 03:15:03 changed by paulproteus

I don't think I filed this bug, but I'm happy to help fix it if I can. (Do I remember that wrong? Who did file it?)

 is an example of a character with a circumflex - it's a particular accent.

In general, you should probably use the :word: character class (AKA \w) as described at http://www.pcre.org/pcre.txt, plus a few choice pieces of punctuation. But on the other hand this is usernames, not users' real names! So you can probably get away with just A-Za-z0-9 plus some choice punctuation.

06/01/08 21:58:32 changed by jjb

  • milestone changed from 1.0.3 to 1.1.

hah- asheesh, thanks for the info, in spite of it not being your bug.

Log in with username/password: lyceum/lyceum