Supplying username allows \r in name

[anonymous]

I constantly get users in the database which have been created by spammers. It is impossible to delete these, when they have a \r in the username, as all WEB-interface fail to handle these correctly. Creating such users should be prevented.

[Steffen Hoffmann]

The proposed patch for #5295 allows for white-listing arbitrary usernames by admin-supplied regexp.

Certainly there are applications, that could still allow \r in usernames, so we shouldn't hard-code a solution for this issue anyway. Previously I tended to not implement the regexp extension introduced by a patch to the aforementioned ticket, but now this is a valid use case.

I have still to think about a meaningful error message, since reporting a regexp to the average user in cleartext, as was suggested, looks definitely flawed to me.

Anyway, we'll stick to the pre-existing proposal.

[anonymous]

Well, when the "\r" in user name is supported, then the remaining functions also need to support it - namely the delete user function :-)

[Steffen Hoffmann]

Replying to anonymous:

Well, when the "\r" in user name is supported, then the remaining functions also need to support it - namely the delete user function :-)

Good point, one more to think it twice again. Admittedly I've not thought much about that lately.