diff --git a/public/src/utils.js b/public/src/utils.js index 433aee8fc8..103eefe7fe 100644 --- a/public/src/utils.js +++ b/public/src/utils.js @@ -385,7 +385,7 @@ }, isUserNameValid: function (name) { - return (name && name !== '' && (/^['"\s\-+.*[\]0-9\u00BF-\u1FFF\u2C00-\uD7FF\w]+$/.test(name))); + return (name && name !== '' && (/^['" \-+.*[\]0-9\u00BF-\u1FFF\u2C00-\uD7FF\w]+$/.test(name))); }, isPasswordValid: function (password) { diff --git a/src/user/approval.js b/src/user/approval.js index eed91f5837..dec0bb7e2d 100644 --- a/src/user/approval.js +++ b/src/user/approval.js @@ -13,6 +13,7 @@ const plugins = require('../plugins'); module.exports = function (User) { User.addToApprovalQueue = async function (userData) { + userData.username = userData.username.trim(); userData.userslug = utils.slugify(userData.username); await canQueue(userData); const hashedPassword = await User.hashPassword(userData.password); diff --git a/test/user.js b/test/user.js index e848202bb6..21cb643199 100644 --- a/test/user.js +++ b/test/user.js @@ -1805,6 +1805,23 @@ describe('User', function () { }); }); }); + + it('should trim username and add user to registration queue', function (done) { + helpers.registerUser({ + username: 'invalidname\r\n', + password: '123456', + 'password-confirm': '123456', + email: 'invalidtest@test.com', + gdpr_consent: true, + }, function (err) { + assert.ifError(err); + db.getSortedSetRange('registration:queue', 0, -1, function (err, data) { + assert.ifError(err); + assert.equal(data[0], 'invalidname'); + done(); + }); + }); + }); }); describe('invites', function () { diff --git a/test/utils.js b/test/utils.js index e0e4eb857a..09c608aba9 100644 --- a/test/utils.js +++ b/test/utils.js @@ -63,10 +63,30 @@ describe('Utility Methods', function () { assert.equal(utils.isUserNameValid(username), false, 'accepted as valid username'); }); + it('should reject new lines', function () { + assert.equal(utils.isUserNameValid('myusername\r\n'), false); + }); + + it('should reject new lines', function () { + assert.equal(utils.isUserNameValid('myusername\n'), false); + }); + + it('should reject tabs', function () { + assert.equal(utils.isUserNameValid('myusername\t'), false); + }); + it('accepts square brackets', function () { var username = '[best clan] julian'; assert(utils.isUserNameValid(username), 'invalid username'); }); + + it('accepts regular username', function () { + assert(utils.isUserNameValid('myusername'), 'invalid username'); + }); + + it('accepts quotes', function () { + assert(utils.isUserNameValid('baris "the best" usakli'), 'invalid username'); + }); }); describe('email validation', function () {