Kimirock/osTicket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

issue: Ensure User Login Name

Browse Source 
This ensures the actor's login name is of an acceptable format before
attempting authentication. This also updates `is_userid()` to accept a
new param of `$verify` that is passed through to `is_email()`.
This commit is contained in:
JediKev
2026-01-13 16:16:55 -06:00
parent d1b634a9e7
commit 6852e7197e
3 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/class.validator.php
View File

@@ -229,9 +229,9 @@ class Validator {
return $error == '';
}
static function is_userid($userid, &$error='') {
static function is_userid($userid, &$error='', $verify=false) {
if (!self::is_username($userid)
&& !self::is_email($userid))
&& !self::is_email($userid, false, $verify))
$error = __('Invalid User Id ');
return $error == '';
}

5
login.php
View File

@@ -48,8 +48,9 @@ if ($_POST) {
if ($_POST && isset($_POST['luser'])) {
if (!$_POST['luser'])
$errors['err'] = __('Valid username or email address is required');
elseif (($user = UserAuthenticationBackend::process(trim($_POST['luser']),
substr($_POST['lpasswd'], 0, 128), $errors))) {
elseif (Validator::is_userid(trim($_POST['luser']), $errors['err'], false)
&& ($user = UserAuthenticationBackend::process(trim($_POST['luser']),
substr($_POST['lpasswd'], 0, 128), $errors))) {
if ($user instanceof ClientCreateRequest) {
if ($cfg && $cfg->isClientRegistrationEnabled()) {
// Attempt to automatically register

5
scp/login.php
View File

@@ -68,8 +68,9 @@ if ($_POST) {
if ($_POST && isset($_POST['userid'])) {
// Lookup support backends for this staff
$username = trim($_POST['userid']);
if ($user = StaffAuthenticationBackend::process($username,
substr($_POST['passwd'], 0, 128), $errors)) {
if (Validator::is_userid($username, $errors['err'], false)
&& ($user = StaffAuthenticationBackend::process($username,
substr($_POST['passwd'], 0, 128), $errors))) {
$redirect($user->isValid() ? $dest : 'login.php');
}