#1057 more permissive defaults on username and channelname regexpressions

Unassigned
open
nobody
5
2013-02-14
2012-12-01
Kissaki
No

Our Murmur.ini currently provides as defaults for username and channelname:

channelname=[ \-=\w\#\[\]\{\}\(\)\@\|]+
username=[-=\w\[\]\{\}\(\)\@\|\.]+

Natenom suggested - which I second - to make them more permissive.

New and non tech- or computer-savy people may get confused or get hindered to connect to servers when they - for example - try to connect with their fore and surname separated by a space.

Specific characters give problems or may be abused, and should does not be allowed:
< and ´>` which will get interpreted as HTML in parts of the client
special Unicode control characters
* specific unicode characters (above or below general text-line)

I guess staying with a white-list is the more secure and robust solution.
So I’d suggest adding space as an allowed character to username.

username=[^\s][ -=\w\[\]\{\}\(\)\@\|\.]+[^\s]

Of course, we would not want to allow it as leading or ending whitespace.
Adding that will make the regexp longer and more complicated.

However we could keep the simple regexp as commented out documentation in the ini as we do now.
I’d weight user-fiendlyness higher than a very simple regexp as the default value, that is seen in webinterfaces as the current value.

Aside:
A basis for discussion as a blacklist:

username=^\s<>[^\s<>]
channelname=^\s<>
[^\s<>]

which denies leading and ending whitespace, as well as whitespace following whitespace.

Documentation on Qt regexps:
http://doc.qt.digia.com/qt/qregexp.html#details

Discussion


Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

JavaScript is required for this form.





No, thanks