We had a report of a user who generated watchdog errors when attempting to log in, and mistakenly including a bracket in the username. The error was as follows:

Warning: preg_grep(): Compilation failed: missing terminating ] for character class at offset 109 in login_security_validate() (line 236 of /sites/all/modules/login_security/login_security.module).

On further investigation, it is clear the issue is in the preg_grep call in Login Security. The $name is not properly escaped, and will created an error if a single bracket (for example, "[") is entered in the username.

See the attached patch which should correct the issue. Thank you.

CommentFileSizeAuthor
#2 login_security-preg_grep_error-3143621-2.patch909 bytesron_s
login_security-preg_grep_error-1.patch905 bytesron_s
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

ron_s created an issue. See original summary.

ron_s’s picture

ron_s CreditAttribution: ron_s commented
Title: Compliation failed error when name contains single bracket » Validation function does not properly escape inputs when using preg_grep
FileSize
login_security-preg_grep_error-3143621-2.patch909 bytes

Have also noticed it does not properly handle a forward slash when validating. Updated patch handles the issue, see attached.