Don't allow hash signs in usernames

diff --git a/app/models/user.rb b/app/models/user.rb
index a04d0f23c1b8eb35b80bf8be95c91baa527e65e7..b6c126076bd29d5305a475c07b738e566cf7440a 100644 (file)
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -33,7 +33,7 @@ class User < ActiveRecord::Base
   validates_length_of :display_name, :within => 3..255, :allow_nil => true
   validates_email_format_of :email, :if => Proc.new { |u| u.email_changed? }
   validates_email_format_of :new_email, :allow_blank => true, :if => Proc.new { |u| u.new_email_changed? }
-  validates_format_of :display_name, :with => /^[^\/;.,?%]*$/, :if => Proc.new { |u| u.display_name_changed? }
+  validates_format_of :display_name, :with => /^[^\/;.,?%#]*$/, :if => Proc.new { |u| u.display_name_changed? }
   validates_format_of :display_name, :with => /^\S/, :message => "has leading whitespace", :if => Proc.new { |u| u.display_name_changed? }
   validates_format_of :display_name, :with => /\S$/, :message => "has trailing whitespace", :if => Proc.new { |u| u.display_name_changed? }
   validates_numericality_of :home_lat, :allow_nil => true

diff --git a/test/unit/user_test.rb b/test/unit/user_test.rb
index 225eca02b491387535ebb4d3f5e18c16ba82024f..88019e2f5bfafe0104419835cf3b6f10be352a05 100644 (file)
--- a/test/unit/user_test.rb
+++ b/test/unit/user_test.rb
@@ -81,12 +81,12 @@ class UserTest < ActiveSupport::TestCase
     # Due to sanitisation in the view some of these that you might not 
     # expact are allowed
     # However, would they affect the xml planet dumps?
-    ok = [ "Name", "'me", "he\"", "#ping", "<hr>", "*ho", "\"help\"@", 
+    ok = [ "Name", "'me", "he\"", "<hr>", "*ho", "\"help\"@", 
            "vergrößern", "ルシステムにも対応します", "輕觸搖晃的遊戲" ]
     # These need to be 3 chars in length, otherwise the length test above
     # should be used.
     bad = [ "<hr/>", "test@example.com", "s/f", "aa/", "aa;", "aa.",
-            "aa,", "aa?", "/;.,?", "も対応します/" ]
+            "aa,", "aa?", "/;.,?", "も対応します/", "#ping" ]
     ok.each do |display_name|
       user = users(:normal_user)
       user.display_name = display_name