* Blocking some Unicode whitespace characters in usernames. Should check

  if some or all should be blocked from all page titles.

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 5b7078a..c98fd12 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -611,6 +611,8 @@ fully support the editing toolbar, but was found to be too confusing.
 * (bug 4824) Separate out IE7 CSS compat hacks, fix for RTL pages
 * Added support for wikidiff2 and similar external diff engines.
 * Allow cookies to be shared between multiple wikis with a shared user database
+* Blocking some Unicode whitespace characters in usernames. Should check
+  if some or all should be blocked from all page titles.
 
 
 === Caveats ===

diff --git a/includes/User.php b/includes/User.php
index d1861ac..c293125 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -210,8 +210,22 @@ class User {
                        || $parsed->getNamespace()
                        || strcmp( $name, $parsed->getPrefixedText() ) )
                        return false;
-               else
-                       return true;
+               
+               // Check an additional blacklist of troublemaker characters.
+               // Should these be merged into the title char list?
+               $unicodeBlacklist = '/[' .
+                       '\x{0080}-\x{009f}' . # iso-8859-1 control chars
+                       '\x{00a0}' .          # non-breaking space
+                       '\x{2000}-\x{200f}' . # various whitespace
+                       '\x{2028}-\x{202f}' . # breaks and control chars
+                       '\x{3000}' .          # ideographic space
+                       '\x{e000}-\x{f8ff}' . # private use
+                       ']/u';
+               if( preg_match( $unicodeBlacklist, $name ) ) {
+                       return false;
+               }
+               
+               return true;
        }
 
        /**