script for solving ticket http://hackers.devnet.ro/ticket/269

Reviews
Diff

- Download Diff

Information
Submitter:	Savin Tiberiu
Repository:	infoarena
Branch:
Bugs:
Depends On:
Reviewers
Groups:	hackers
People:

Description

/script/db_username_validate.php validates fields usernames from ia_user and membername from ia_smf_members. Invalid characters are determined according to IA_RE_USER_NAME and are replaced with '_'.
It gives a warning when running "Warning: finfo_open missing, falling back to mime_content_type" about which I have absolutely no idea.

Testing Done

I added in both tabels many users with names containing invalid characters ([]$* etc) and after running the script those characters were replaced by '_'.

Change Summary:

I forgot to add the script :-"

Diff:

Revision 2 (+53 -4)

Show changes

	/trunk/common/common.php
	/trunk/common/user.php
	/trunk/scripts/db_username_validate.php
	/trunk/www/controllers/register.php

Should we also e-mail the affected users? How will they know the username was changed? Another possibility is to check this at login, and change the username to the new one automatically. For example, someone enters al[]exthero and the system logs in the user al__exthero.

Also, what happens if we have two users: al[]exthero and al$$exthero. Using this script they will both be changed to al__exthero. I am not sure if we should think about this case or not (do we have anything like this?).

Savin Tiberiu Jan. 19, 2009, 10:15 p.m.

"Post a list in the forum or on the wiki." this is the solution in the ticket. 

Are there so many invalid users in the database? Let's hope there won't be two users with the same name after running the script. Anyway the script will stop if you try to duplicate an username (I tested this when I had a bug and all characters were considered invalid :D).

I think we're missing some stuff here. For example, we should also rename the user profile page.

Following is a list of comments pertaining coding style.

/trunk/scripts/db_username_validate.php (Diff revision 2)

coding style: no space after define

/trunk/scripts/db_username_validate.php (Diff revision 2)

coding style: space before {

/trunk/scripts/db_username_validate.php (Diff revision 2)

coding style: always use { code blocks }, even for one instruction

if (...) {
    ...
} else {
    ...
}

/trunk/scripts/db_username_validate.php (Diff revision 2)

coding style: no trailing whitespace;

/trunk/scripts/db_username_validate.php (Diff revision 2)

coding style: no trailing whitespace

Change Summary:

Now I'm using a clone of textblock_move from textblock.php to move the profile pages. I am using a clone because I had to remove log_assert(is_normal_page_name($old_name));

Diff:

Revision 3 (+121 -4)

Show changes

	/trunk/common/common.php
	/trunk/common/user.php
	/trunk/scripts/db_username_validate.php
	/trunk/www/controllers/register.php

Change Summary:

Now it also echo-es a list of changed usernames

Diff:

Revision 4 (+119)

Show changes

/trunk/scripts/db_username_validate.php

/trunk/scripts/db_username_validate.php (Diff revision 4)

} else {

Also, you're using both spaces and tab characters for indentation in the script

/trunk/scripts/db_username_validate.php (Diff revision 4)

You probably just want "SELECT `$field` FROM `$table`", you don't need to select all, and "WHERE" is optional (not needed here). All variables that go in a database query should be escaped with db_escape or db_quote

/trunk/scripts/db_username_validate.php (Diff revision 4)

Do this update just if $user_name != $new_user_name

/trunk/scripts/db_username_validate.php (Diff revision 4)

Again don't select * since there are a lot of textblocks and their text would use up a lot of memory.

SELECT `name` FROM ia_textblock WHERE `name` LIKE 'utilizator/%'

This will match all textblock pages whose name start with utilizator/

/trunk/scripts/db_username_validate.php (Diff revision 4)

Extra tab

Code looks mostly ok now :) I tried this on a copy of the database from a month ago.

Had problems with the following usernames:
":))" -> "___" already exists
"Darth Niculus" -> "Darth_Niculus" already exists
"Mircescu Alexandru" -> "Mircescu_Alexandru" already exists

Neither of the three accounts submitted any solutions so maybe we can just delete them? :-"
The script should probably check if the new name already exists and give a warning so it doesn't stop in the middle with database failure.

/trunk/scripts/db_username_validate.php (Diff revision 10)