Skip to content
This repository was archived by the owner on Jan 24, 2019. It is now read-only.

Bug 916896 - Check for valid usernames #24

Open
cadecairos wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bug 916896 - Check for valid usernames #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ var request = require( "request" ),
Fogin = require( "./test/Fogin.js" ),
persona = require( "express-persona" );

var USERNAME_REGEX = /^[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\-\_]{1,20}$/;
Copy link
Copy Markdown
Contributor

@humphd humphd Sep 16, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It sucks that we have multiple places where this needs to be maintained. I know how to fix that, but it will add a ton of overhead too. Sucks either way.


/**
* Module.exports
**/
Expand Down Expand Up @@ -54,6 +56,10 @@ module.exports = function ( app, options ) {

var loginAPI = {
getUser: function ( id, callback ) {
if ( !USERNAME_REGEX.test( id ) ) {
// invalid username
return callback( "Invalid Username" );
Copy link
Copy Markdown
Contributor

@humphd humphd Sep 16, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For both these checks (here and the new one below in isAdmin), we're going to have to make sure that downstream consumers are doing the proper error handling (they should be, but keep this in mind, since we just introduced a new error case they all need to care about). Probably reflecting this change in as a more major version bump is a good idea.

}
request({
auth: {
username: authBits.user,
Expand Down Expand Up @@ -88,6 +94,10 @@ module.exports = function ( app, options ) {
});
},
isAdmin: function ( id, callback ) {
if ( !USERNAME_REGEX.test( id ) ) {
// invalid username
return callback( "Invalid Username" );
}
request({
auth: {
username: authBits.user,
Expand Down