Bug 499424
| Summary: | RHN User Creation allows use of special characters forbidden on web | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Retired] Red Hat Network | Reporter: | Amanda Carter <acarter> | ||||
| Component: | RHN/Web Site | Assignee: | Grant Gainey <ggainey> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Red Hat Network Quality Assurance <rhn-qa-list> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | RHN Stable | CC: | acarter, acressma, awood, dhughes, rhn-bugs | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | US = 92546 | ||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2010-03-17 23:33:18 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 516901 | ||||||
| Attachments: |
|
||||||
Created attachment 342682 [details]
Web User Creation
The web uses to apis to validate user creation: validateUser (for email, address, etc) and validateUsername (for user name only). Currently RHN is only calling validateUser. From an IRC conversation:
> yes, it looks like calling that method will be sufficient
> Here's the regex, FYI
> ^[^"$<> $\^|\+\%\\(),=;~:/\*]*$
> and the length has to be > 5
> or possibly >= 5
> I'll leave that as an exercise for the reader.
Verified in webdev.
Verified the following characters are not accepted when creating a user in RHN:
" $ ^ < > | + % \ ( ) , = ; ~ : / * (whitespace) ' ` # &
Verified the following characters are accepted:
- _ . @ ! [ ] { } ?
|
Description of problem: When creating a user on rhn.redhat.com, it appears that the web form only forbids: ( ) < > { } This should not be a problem if User Service were configured correctly to forbid these characters. Need to investigate with AM what we talk to, what the rules for that service is and what we/it *should* be doing. This is a high priority bug b/c users with special characters like these are not able to log into iSupport to get support. This issue may go away when/if new ticketing is implemented...