From f1892179491d68ad0b72913bc7c1b682e81afa2a Mon Sep 17 00:00:00 2001 From: schneefux Date: Sun, 28 Aug 2016 14:47:26 +0200 Subject: validate usernames --- app.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'app.py') diff --git a/app.py b/app.py index 8f66efc..4e386c8 100644 --- a/app.py +++ b/app.py @@ -384,12 +384,16 @@ class DBProxy(object): return 1-j['freshness'] if sortby == 'score': return j['score'] - return (j['score']+1)/pow(j['freshness']+1, 1.8) # 'rank' or invalid + # 'rank' or invalid + return (j['score']+1)/pow(j['freshness']+1, 1.8) ret_jokes = sorted(ret_jokes, key=sorter, reverse=True) return ret_jokes def add_user(self, name, password): + # allow words combined by '.', '-', ' ' + if re.match(r"^\w+(([. -])?\w+)*$", name) is None or len(name) < 3: + return -3 # invalid username if self.get_user(name=name) != -2: return -1 # already registered password = password.encode('utf-8') @@ -419,6 +423,10 @@ class DBProxy(object): uid = self.c.lastrowid else: if name is not None: + # validate username, see add_user + if re.match(r"^\w+(([. -])?\w+)*$", name) is None or len(name) < 3: + return -3 # invalid username + user = self.c.execute("SELECT id FROM " + self.prefix + "_users WHERE identifier=?", (name,)).fetchone() @@ -618,6 +626,8 @@ def login(): flash('Erfolgreich registriert.') res = db().get_user(name=name, password=passw) + if res == -3: + flash('Benutzername ungültig.') if res == -2: flash('Benutzer existiert nicht.') if res == -1: -- cgit v1.3.1