Changeset 18152

Timestamp:

Sep 22, 2012, 4:31:50 PM (12 years ago)

Author:

Eric

Message:

Bug 2749 fixed - regex meta-characters are usable in character exclusion in usernames
Next version will be 2.40.6

Location:

extensions/UserAdvManager/trunk

Files:

• changelog.txt.php (modified) (1 diff)
• include/functions.inc.php (modified) (1 diff)

extensions/UserAdvManager/trunk/changelog.txt.php

@@ -340 +340 @@
             Update it_IT, thanks to : Ericnet and virgigiole
 
--- 2.41.0 : Bug 2744 fixed - User connexion rejection does not work if no group/status/privacy is set
+-- 2.40.6 : Bug 2744 fixed - User connexion rejection does not work if no group/status/privacy is set
+                                                      Bug 2749 fixed - regex meta-characters are usable in character exclusion in usernames
             New unvalidated user controls more efficient
             Get admins emails instead of webmaster's for sending validation email

extensions/UserAdvManager/trunk/include/functions.inc.php

@@ -2367 +2367 @@
     for ($i = 0 ; $i < count($conf_CharExclusion) ; $i++)
     {
-      $pattern = '/'.$conf_CharExclusion[$i].'/i';
+         //Detect meta-characters (# ! ^ $ ( ) [ ] { } ? + * . \ -) for special pattern
+         if ($conf_CharExclusion[$i] == "#"
+                                                        or $conf_CharExclusion[$i] == "$"
+                                                        or $conf_CharExclusion[$i] == "!"
+                                                        or $conf_CharExclusion[$i] == "^"
+                                                 or $conf_CharExclusion[$i] == "*"
+                                                        or $conf_CharExclusion[$i] == "?"
+                                                        or $conf_CharExclusion[$i] == "+"
+                                                        or $conf_CharExclusion[$i] == "."
+                                                        or $conf_CharExclusion[$i] == "\\"
+                                                        or $conf_CharExclusion[$i] == "|"
+                                                        or $conf_CharExclusion[$i] == "["
+                                                        or $conf_CharExclusion[$i] == "]"
+                                                        or $conf_CharExclusion[$i] == "("
+                                                        or $conf_CharExclusion[$i] == ")"
+                                                        or $conf_CharExclusion[$i] == "{"
+                                                        or $conf_CharExclusion[$i] == "}"
+                                                        or $conf_CharExclusion[$i] == "-")
+         {
+                 $pattern = '/[][^$.\*+?(){}#|-]/i';
+         }
+         else
+                                                {
+                                                                $pattern = '/'.$conf_CharExclusion[$i].'/i';
+                                                }
+
       if (preg_match($pattern, $login))
       {