Reading #827468: Fix the allowed punctuation wording in user_edit_form, I am surprised Drupal allowed to use symbol (e.g ©) and punctuation (e.g. CJK:。) as username.

At sign up screen:

Spaces are allowed; punctuation is not allowed except for periods, hyphens, apostrophes, and underscores.

It seems like a bug.

CommentFileSizeAuthor
#5 1290528-5.patch3.13 KBjazio
#3 1290528-3.patch2.84 KBwiifm

Comments

dave reid’s picture

Considering the username is the "login name" are you looking more for a "real name" type of display? If so, you should look at using http://drupal.org/project/realname.

droplet’s picture

Issue summary: View changes

Updated issue summary.

wiifm’s picture

Assigned: Unassigned » wiifm
Issue summary: View changes
Issue tags: +Drupal8NZ

Assigning myself to look at this, able to replicate this on the latest 8.0.x

wiifm’s picture

Title: Disallow more punctuation/symbol in Username » Disallow English symbols and math characters in Username
Assigned: wiifm » Unassigned
Status: Active » Needs review
StatusFileSize
new2.84 KB

So it turns out this is a rather complex beast, I was using http://unicode-table.com/ for reference, and there is a large amount of unicode characters out there.

I have excluded U+00A1 through U+00BF which covers most English symbols and math characters. All of which I would argue make no sense being in a username. Amended title of the issue to reflect this.

Added tests, and amended an existing one.

Tests pass with

sudo -u www-data php core/scripts/run-tests.sh --verbose --url http://d8.localhost/ --file core/modules/user/src/Tests/UserValidationTest.php

quietone’s picture

Works fine for excluding characters on a typical keyboard. But I could still add other math symbols, such as 27C0— 27EF as well as other characters/symbols that seem wrong in a name.

Would it be easier to test for allowed, presumably Latin, characters?

jazio’s picture

StatusFileSize
new3.13 KB

I added more checks on more math symbols and ideographic descriptions.

joelpittet’s picture

Version: 8.0.x-dev » 8.1.x-dev

This looks good though due to it being marked as a Feature request I'll bump it to 8.1.x. We can move it back to a patch release if it's a bug.

swentel’s picture

This would mean I can't use my email address anymore as my username, which I often do ..
This really doesn't seem like a bug, nor feature to me, just by design.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.0-beta1 was released on March 2, 2016, which means new developments and disruptive changes should now be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

alexpott’s picture

Status: Needs review » Closed (works as designed)

Disallowing characters which are currently allowed can't really happen. What do we do for existing sites? An upgrade path is going to be impossible. And even if we filed this for D9 what is the migration path?