• Registered: 2007-02-15
  • Posts: 1

Topic: Bug: Take an already existing username and make it to your username.

If someone has an little a in his or hers username, you can take it by switching a with а. Of some reason will the forum, if powered by PunBB, make this to an a. If this is rather an Easter Egg tha an bug i recommend you at PunBB to erase this function, since this leads to confusion by many.

  • Smartys
  • Former PunBB Developer
  • Offline
  • Registered: 2004-04-30
  • Posts: 7,844

Re: Bug: Take an already existing username and make it to your username.

&#1072 is a in another charset, displaying it properly is the correct way to do things wink
However, we will look into dealing with this better

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: Bug: Take an already existing username and make it to your username.

This should fix itself when we switch to UTF-8 because then we will accept HTML entities (and numeric character references) literally.

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

  • From: France
  • Registered: 2004-11-06
  • Posts: 695

Re: Bug: Take an already existing username and make it to your username.

In fact, nope. Not without sanitizing. See my latest comment on your web log about unicode.

Numeric or plain entities are just a way old HTML had to use to display non-ascii character, but these characters (two or more looking like each others) can be input with a keyboard, or using an external program and then copy-paste unto the browser.

There are several simple way to deal with that (and of course more complex and smarter way), I waited for the 1.3 to be open for comment to talk about it.

Jeu de rôle en ligne sur table virtuelle ⁂ Shadowrun France ⁂ Chez Blacky

Jérémie's Website

5 Reply by Kossu

  • Kossu
  • Junior Member
  • Offline
  • Registered: 2007-01-21
  • Posts: 3

Re: Bug: Take an already existing username and make it to your username.

in register.php find:
message($lang_prof_reg['Username BBCode']);
and after add

else if (strpos($username, '&') !== false && strpos($username, ';') !== false)
message('Disallowed entity reference in username');

That should do it