validate usernames

1 files changed, 3 insertions, 1 deletions

diff --git a/lib/register.js b/lib/register.js
index b43a0ce7..f6f0ff75 100644
--- a/lib/register.js
+++ b/lib/register.js
@@ -9,13 +9,15 @@ import { s, g, archive } from "$lib/db";
 import { l, warn } from "$lib/logging";
 import { fail, getUser } from "$lib/utils";
 
+let valid = /^\p{L}{2,24}$/u;
 export default async (user, ip, requireChallenge) => {
   let { profile, password, pubkey, username } = user;
   l("registering", username);
 
   if (!username) fail("Username required");
-
   username = username.replace(/ /g, "").toLowerCase();
+  if (!valid.test(username)) fail("Usernames can only have letters and numbers");
+
   let id = v4();
   user.id = id;