Problem with periods in usernames

Osama · June 2, 2021, 6:40am

Ok this PR should fix this bug:

github.com/discourse/discourse

FIX: Escape periods in current user's username before generating `RegExp`

discourse:master ← discourse:fix/escape-periods-in-username

opened 06:39AM - 02 Jun 21 UTC

OsamaSayegh

+323 -1

If we don't escape periods, they are interpreted as wildcards and it becomes imp…ossible to visit profiles of other users whose usernames match. E.g., if your username was `a.c` and attempted to visit `abc`'s profile, you would be incorrectly redirected to your own profile. Meta topic: https://meta.discourse.org/t/problem-with-periods-in-usernames/192195?u=osama.

Thanks for reporting this @alex21!

Topic		Replies	Views
Any account with username "adman" has a broken profile support	6	283	July 6, 2023
Username with space causing problems? support	5	1837	November 4, 2016
Any unicode character can be exploited onto the user's name bug	3	572	May 3, 2023
Dismissing autocomplete of username feature	19	2351	February 10, 2016
So many broken users due to corrupt database support	16	1357	April 27, 2020

Problem with periods in usernames

Related Topics