X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/7441f15b4fd59735ae00a16b47cfcf7eb99260a6..88e048deea4a543ac3129e3a5f0b3b7b94160f35:/app/models/user.rb

diff --git a/app/models/user.rb b/app/models/user.rb
index aaa00169f..42759dbd5 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -88,12 +88,17 @@ class User < ActiveRecord::Base
                     :default_url => "/assets/:class/:attachment/:style.png",
                     :styles => { :large => "100x100>", :small => "50x50>" }
 
+  INVALID_CHARS = "/;.,?%#"
+
   validates :display_name, :presence => true, :allow_nil => true, :length => 3..255,
                            :exclusion => %w[new terms save confirm confirm-email go_public reset-password forgot-password suspended]
   validates :display_name, :if => proc { |u| u.display_name_changed? },
                            :uniqueness => { :case_sensitive => false }
   validates :display_name, :if => proc { |u| u.display_name_changed? },
-                           :format => { :with => %r{\A[^\x00-\x1f\x7f\ufffe\uffff/;.,?%#]*\z} }
+                           :format => { :with => %r{\A[^\x00-\x1f\x7f\ufffe\uffff]*\z} }
+  validates :display_name, :if => proc { |u| u.display_name_changed? },
+                           :format => { :with => %r{\A[^#{INVALID_CHARS}]*\z},
+                                        :message => "cannot contain invalid chars: #{INVALID_CHARS}", invalid_chars: INVALID_CHARS }
   validates :display_name, :if => proc { |u| u.display_name_changed? },
                            :format => { :with => /\A\S/, :message => "has leading whitespace" }
   validates :display_name, :if => proc { |u| u.display_name_changed? },
@@ -211,7 +216,7 @@ class User < ActiveRecord::Base
                    .where("id != ?", id)
                    .where(sql_for_area)
                    .where("#{sql_for_distance} <= ?", radius)
-                   .order(sql_for_distance)
+                   .order(Arel.sql(sql_for_distance))
                    .limit(num)
     else
       nearby = []