Anonymous checkout allow user to be created with illegal characters in username
j0rd - May 28, 2009 - 10:20
| Project: | Ubercart |
| Version: | 6.x-2.0-rc3 |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
| Issue tags: | ubercamp sprint |
Description
This is a minor bug, but probably one that should get resolved for consistency.
In Ubercart, when we have an anonymous checkout, we create a username based off of the email address. Unfortunately in this process we do not check to see if that generated username contains characters Drupal considers invalid. This could create issues in the future, but currently, we're able to login with a generated username which contains invalid characters.
To resolve this we check check the username against
<?php
function user_validate_name($name)
?><?php
function uc_store_email_to_username($mail)
?>Maybe more work than it's worth, but I figure I'd bring it up.
#1
oh. Invalid email example would be a special gMail one like:
myemail+spamtag@gmail.com
Drupal doesn't allow the '+'
#2
Issue sounds worth fixing to me; is there an API function we can use to strip out illegitimate characters?
#3
Not that I can see. I was planning on repurposing the validate function for this purpose. Unless I'm blind and missed it. :)
#4
Why don't we just reduce the username to alphanumeric characters to begin with? There's no real need to preserve periods in the usernames, and that's all I can imagine someone would have in their e-mail addy. I don't think hyphens or underscores are allowed. I'm sure alphanumeric names will pass validation. : )
#5
#6
#7
Code copied from the user_import module's _user_import_sanitise_username().
#8
On second thought, this patch may be more appropriate since we're starting with an email address.
#9
I don't think
[:alnum:]works in preg_replace(). I've only seen it in MySQL regular expressions.(Oh, it also works in ereg_replace(). Interesting.)
Here's an equivalent expression in PCRE syntax.
#10
Worked for me. Thanks everyone!
#11
#12
Yarrr, the old 3-liner
#13
You be da man. Yarr.
#14
Automatically closed -- issue fixed for 2 weeks with no activity.