Skip to content
This repository has been archived by the owner on Jan 8, 2019. It is now read-only.

Single quotes in username are bad #1005

Closed
magicalbob opened this issue Dec 12, 2014 · 0 comments
Closed

Single quotes in username are bad #1005

magicalbob opened this issue Dec 12, 2014 · 0 comments
Assignees
Milestone

Comments

@magicalbob
Copy link

Adding a user with a single quote in username is accepted by graylog2-web-interface, but you can't log in with that user and you can't delete the user.

Add

        if (username.indexOf("'") > -1 ) {
          validationFailure( createUsernameField, "Username can't have quotes.");
          domElement.setCustomValidity('Username cannot have quotes.');
        } else {
          $.ajax({

.
.
.

          });
        }

to app/assets/javascripts/main.js stops anyone from doing something stupid like putting a single quote in a username.

I'm a newb and haven't worked out how to commit changes .......

@kroepke kroepke added this to the 0.93 milestone Jan 12, 2015
@kroepke kroepke self-assigned this Jan 20, 2015
luca-digrazia pushed a commit to luca-digrazia/DatasetCommitsDiffSearch that referenced this issue Sep 4, 2022
    there were two issues:
     * the rest routes weren't url escaping the path parameters (this creates an implicit dependency on guava > 15.0!)
     * the api client used MessageFormat to create the path template, but that could kill certain unescaped characters like quotes

    now users with single or douple quotes in their username will be able to successfully log in

    fixes graylog-labs/graylog2-web-interface#1005
    fixes graylog-labs/graylog2-web-interface#1006
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants