From f977b8ee3e46b3b3ead86d08b3ef6298a4b430b9 Mon Sep 17 00:00:00 2001 From: Marian Sigler Date: Fri, 5 Oct 2012 22:09:57 +0200 Subject: Disallow usernames starting with admin or root. Allow digits. --- utils.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'utils.py') diff --git a/utils.py b/utils.py index 24a17b2..573345d 100644 --- a/utils.py +++ b/utils.py @@ -10,14 +10,17 @@ from Crypto.Cipher import AES from email.mime.text import MIMEText from functools import wraps from flask import current_app, flash, g, redirect, render_template, request, session, url_for +from flask.ext.wtf import ValidationError from hashlib import sha1 from random import randint from time import time from werkzeug.exceptions import Forbidden +from wtforms.validators import Regexp -_username_re = re.compile(r'^[-a-zA-Z]{2,16}') +_username_re = re.compile(r'^[a-zA-Z][a-zA-Z0-9-]{1,15}') +_username_exclude_re = re.compile(r'^(admin|root)') # using http://flask.pocoo.org/docs/patterns/viewdecorators/ def templated(template=None): @@ -212,3 +215,15 @@ def send_register_confirmation_mail(username, mail): send_mail(mail, u'E-Mail-Adresse bestätigen', body, sender=current_app.config.get('MAIL_CONFIRM_SENDER')) + + +class NotRegexp(Regexp): + """ + Like wtforms.validators.Regexp, but rejects data that DOES match the regex. + """ + def __call__(self, form, field): + if self.regex.match(field.data or u''): + if self.message is None: + self.message = field.gettext(u'Invalid input.') + + raise ValidationError(self.message) -- cgit v1.2.3-1-g7c22