Merge branch 'master' into develop

src/controllers/activitypub/index.js

@@ -48,6 +48,11 @@ Controller.fetch = async (req, res, next) => {
 			}
 		}
 
+		// Force outgoing links page on direct access
+		if (!res.locals.isAPI) {
+			url = new URL(`outgoing?url=${encodeURIComponent(url.href)}`, nconf.get('url'));
+		}
+
 		helpers.redirect(res, url.href, false);
 	} catch (e) {
 		if (!url || !url.href) {

src/controllers/authentication.js

@@ -420,6 +420,10 @@ authenticationController.localLogin = async function (req, username, password, n
 	}
 
 	const userslug = slugify(username);
+	if (!utils.isUserNameValid(username) || !userslug) {
+		return next(new Error('[[error:invalid-username]]'));
+	}
+
 	const uid = await user.getUidByUserslug(userslug);
 	try {
 		const [userData, isAdminOrGlobalMod, canLoginIfBanned] = await Promise.all([