FIX: Stop autocomplete for invalid usernames. (#7005)

discourse · Feb 15, 2019 · a423a93 · a423a93 · SamSaffron · Feb 20, 2019
1 parent f8b70f4
commit a423a93
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/app/assets/javascripts/discourse/lib/user-search.js.es6 b/app/assets/javascripts/discourse/lib/user-search.js.es6
@@ -121,6 +121,10 @@ export default function userSearch(options) {
     topicId = options.topicId,
     group = options.group;
 
+  if (/[^\w.-]/.test(term)) {
+    term = "";
+  }
+
   if (oldSearch) {
     oldSearch.abort();
     oldSearch = null;

diff --git a/test/javascripts/lib/user-search-test.js.es6 b/test/javascripts/lib/user-search-test.js.es6
@@ -1,4 +1,5 @@
 import userSearch from "discourse/lib/user-search";
+import { CANCELLED_STATUS } from "discourse/lib/autocomplete";
 
 QUnit.module("lib:user-search", {
   beforeEach() {
@@ -71,3 +72,8 @@ QUnit.test("it strips @ from the beginning", async assert => {
   let results = await userSearch({ term: "@Team" });
   assert.equal(results[results.length - 1]["name"], "team");
 });
+
+QUnit.test("it does not search for invalid usernames", async assert => {
+  let results = await userSearch({ term: "foo, " });
+  assert.equal(results, CANCELLED_STATUS);
+});