Merge pull request #590 from CTPUG/problematic-usernames

Disallow problematic usernames

wafer/registration/forms.py

@@ -4,15 +4,23 @@
 
 from crispy_forms.helper import FormHelper
 from crispy_forms.layout import Hidden, Submit
+from registration.forms import RegistrationForm
 
+from wafer.registration.validators import validate_username
 
-class RegistrationFormHelper(FormHelper):
-    form_action = reverse('registration_register')
-    include_media = False
 
-    def __init__(self, request, *args, **kwargs):
-        super(RegistrationFormHelper, self).__init__(*args, **kwargs)
-        self.add_input(Submit('submit', _('Sign up')))
+class WaferRegistrationForm(RegistrationForm):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.helper = FormHelper()
+        self.helper.include_media = False
+        self.helper.form_action = reverse('registration_register')
+        self.helper.add_input(Submit('submit', _('Sign up')))
+
+    def clean_username(self):
+        username = self.cleaned_data['username']
+        validate_username(username)
+        return username
 
 
 class LoginFormHelper(FormHelper):

wafer/registration/templates/registration/registration_form.html

@@ -1,9 +1,7 @@
 {% extends 'wafer/base_form.html' %}
 {% load i18n %}
 {% load crispy_forms_tags %}
-{% load wafer_crispy %}
 {% block content %}
 <h1>{% trans 'Sign up' %}</h1>
-{% wafer_form_helper 'wafer.registration.forms.RegistrationFormHelper' as form_helper %}
-{% crispy form form_helper %}
+{% crispy form %}
 {% endblock %}

wafer/registration/validators.py

@@ -0,0 +1,9 @@
+from django.core.exceptions import ValidationError
+
+
+def validate_username(username):
+    """Some usernames lead to problematic URLs and static file names"""
+    if username.startswith('.'):
+        raise ValidationError('usernames cannot start with a "."')
+    if username in ('index.html', 'page'):
+        raise ValidationError('This username is not available')

wafer/settings.py

@@ -199,8 +199,8 @@
 
 # Django registration:
 ACCOUNT_ACTIVATION_DAYS = 7
-
 AUTH_USER_MODEL = 'auth.User'
+REGISTRATION_FORM = 'wafer.registration.forms.WaferRegistrationForm'
 
 # Forms:
 CRISPY_TEMPLATE_PACK = 'bootstrap4'

wafer/users/forms.py

@@ -7,6 +7,7 @@
 from crispy_forms.helper import FormHelper
 from crispy_forms.layout import Submit
 
+from wafer.registration.validators import validate_username
 from wafer.users.models import UserProfile
 
 
@@ -22,6 +23,11 @@ def __init__(self, *args, **kwargs):
         self.fields['first_name'].required = True
         self.fields['email'].required = True
 
+    def clean_username(self):
+        username = self.cleaned_data['username']
+        validate_username(username)
+        return username
+
     class Meta:
         # TODO: Password reset
         model = get_user_model()

wafer/users/views.py

@@ -67,6 +67,9 @@ def get_url(self, obj):
 
     def build_object(self, obj):
         """Override django-bakery to skip profiles that raise 403"""
+        if obj.username in ('.', '..'):
+            log.warning('Skipping build of user %s, bad username', obj.username)
+            return
         try:
             build_path = self.get_build_path(obj)
             self.request = self.create_request(build_path)