From 6f31e8c4dff2897eaf07d1ed5519972e63827462 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Sat, 23 Mar 2024 00:49:26 -0700
Subject: validate usernames

---
 lib/register.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/register.js b/lib/register.js
index b43a0ce7..f6f0ff75 100644
--- a/lib/register.js
+++ b/lib/register.js
@@ -9,13 +9,15 @@ import { s, g, archive } from "$lib/db";
 import { l, warn } from "$lib/logging";
 import { fail, getUser } from "$lib/utils";
 
+let valid = /^\p{L}{2,24}$/u;
 export default async (user, ip, requireChallenge) => {
   let { profile, password, pubkey, username } = user;
   l("registering", username);
 
   if (!username) fail("Username required");
-
   username = username.replace(/ /g, "").toLowerCase();
+  if (!valid.test(username)) fail("Usernames can only have letters and numbers");
+
   let id = v4();
   user.id = id;
 
-- 
cgit v1.2.3