invalidate usernames comprised entirely of whitespace

This commit is contained in:
Riley L. 2024-11-04 14:14:23 +01:00
parent 2b5aa684f1
commit 373242c40a

View file

@ -427,7 +427,8 @@ end
local function r_create_user() local function r_create_user()
local username = query.create_user local username = query.create_user
if username:match("^([%w_ -]+)$") == nil then -- gsub to remove whitespace. disallows username made up entirely of whitespace
if username:gsub("%s+", ""):match("^([%w_ -]+)$") == nil then
return respond_error("invalid username " .. username) return respond_error("invalid username " .. username)
end end
return redirect(string.format("/%s", urlencode(username))) return redirect(string.format("/%s", urlencode(username)))