Bug 499424 - RHN User Creation allows use of special characters forbidden on web
Summary: RHN User Creation allows use of special characters forbidden on web
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Network
Classification: Retired
Component: RHN/Web Site
Version: RHN Stable
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Grant Gainey
QA Contact: Red Hat Network Quality Assurance
URL:
Whiteboard: US = 92546
Depends On:
Blocks: rhn-sprint29
TreeView+ depends on / blocked
 
Reported: 2009-05-06 16:00 UTC by Amanda Carter
Modified: 2010-03-17 23:33 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-03-17 23:33:18 UTC
Embargoed:


Attachments (Terms of Use)
Web User Creation (153.07 KB, image/png)
2009-05-06 16:03 UTC, Amanda Carter
no flags Details

Description Amanda Carter 2009-05-06 16:00:50 UTC
Description of problem:

When creating a user on rhn.redhat.com, it appears that the web form only forbids: ( ) < > { }  This should not be a problem if User Service were configured correctly to forbid these characters. Need to investigate with AM what we talk to, what the rules for that service is and what we/it *should* be doing.

This is a high priority bug b/c users with special characters like these are not able to log into iSupport to get support. This issue may go away when/if new ticketing is implemented...

Comment 1 Amanda Carter 2009-05-06 16:03:07 UTC
Created attachment 342682 [details]
Web User Creation

Comment 2 Amanda Carter 2009-05-07 20:01:17 UTC
The web uses to apis to validate user creation: validateUser (for email, address, etc) and validateUsername (for user name only). Currently RHN is only calling validateUser.

Comment 3 Grant Gainey 2009-08-11 15:07:10 UTC
From an IRC conversation: 

> yes, it looks like calling that method will be sufficient
> Here's the regex, FYI
> ^[^"$&lt;&gt; $\^|\+\%\\(),=;~:/\*]*$
> and the length has to be > 5
> or possibly >= 5
> I'll leave that as an exercise for the reader.

Comment 6 Denise Hughes 2009-08-14 19:11:13 UTC
Verified in webdev.

Verified the following characters are not accepted when creating a user in RHN:
" $ ^ < > | + % \ ( ) , = ; ~ : / * (whitespace) ' ` # &
Verified the following characters are accepted:
- _ . @ ! [ ] { } ?


Note You need to log in before you can comment on or make changes to this bug.