Filter out invalid usernames in tellWho

isaacs · Sep 24, 2012 · a591a18 · a591a18
1 parent ce4124d
commit a591a18
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/brains.js b/brains.js
@@ -129,6 +129,8 @@ function stopWatching (m, who, what, where, words) {
 commands.tell = function (m, who, what, where, words) {
   var tellWho = words[1]
     , msg
+  if (tellWho.match(/[<>]/) || !tellWho)
+    return respond.call(this, who, where, "That's not a valid username.")
   leaveNote.call(this, tellWho, who, what, where)
   msg = "I'll be sure to tell "+tellWho
   respond.call(this, who, where, msg)