# HG changeset patch
# User Marco Cirillo <maranda@lightwitch.org>
# Date 1316057543 0
# Node ID ea6641deec127ab784f705f6bf30332b139bf8b9
# Parent  a46c2326eed774befb9a519f38f4eeed18d688de
mod_register_json: added check for invalid characters in the username.

diff -r a46c2326eed7 -r ea6641deec12 mod_register_json/mod_register_json.lua
--- a/mod_register_json/mod_register_json.lua	Sun Sep 11 23:30:06 2011 +0200
+++ b/mod_register_json/mod_register_json.lua	Thu Sep 15 03:32:23 2011 +0000
@@ -94,9 +94,17 @@
 
 			-- We first check if the supplied username for registration is already there.
 			if not usermanager.user_exists(req_body["username"], req_body["host"]) then
-				usermanager.create_user(req_body["username"], req_body["password"], req_body["host"]);
-				module:log("debug", "%s registration data submission for %s is successful", user, req_body["username"]);
-				return http_response(200, "Done.");
+				-- Sanity checks for the username.
+				if req_body["username"]:find(" ") or req_body["username"]:find("@") or req_body["username"]:find("<") or
+				   req_body["username"]:find(">") or req_body["username"]:find("\"") or req_body["username"]:find("\'") or
+				   req_body["username"]:find("/") then
+					module:log("debug", "%s supplied an username containing invalid characters: %s", user, req_body["username"]);
+					return http_response(406, "Supplied username contains invalid characters, see RFC 6122.");
+				else
+					usermanager.create_user(req_body["username"], req_body["password"], req_body["host"]);
+					module:log("debug", "%s registration data submission for %s is successful", user, req_body["username"]);
+					return http_response(200, "Done.");
+				end
 			else
 				module:log("debug", "%s registration data submission for %s failed (user already exists)", user, req_body["username"]);
 				return http_response(409, "User already exists.");