We had a report of a user who generated watchdog errors when attempting to log in, and mistakenly including a bracket in the username. The error was as follows:

Warning: preg_grep(): Compilation failed: missing terminating ] for character class at offset 109 in login_security_validate() (line 236 of /sites/all/modules/login_security/login_security.module).

On further investigation, it is clear the issue is in the preg_grep call in Login Security. The $name is not properly escaped, and will created an error if a single bracket (for example, "[") is entered in the username.

See the attached patch which should correct the issue. Thank you.

CommentFileSizeAuthor
#2 login_security-preg_grep_error-3143621-2.patch909 bytessgdev
login_security-preg_grep_error-1.patch905 bytessgdev

Comments

ron_s created an issue. See original summary.

sgdev’s picture

sgdev commented
Title: Compliation failed error when name contains single bracket » Validation function does not properly escape inputs when using preg_grep
StatusFileSize
new login_security-preg_grep_error-3143621-2.patch909 bytes

Have also noticed it does not properly handle a forward slash when validating. Updated patch handles the issue, see attached.