diff --git a/app/models/user.rb b/app/models/user.rb index 7882ebbb6c50cbc2e829b435757910256efff197..b52487facef8f96d1593edc762af1033846ae6dc 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -22,6 +22,7 @@ class User < ActiveRecord::Base validates :username, :presence => true, :uniqueness => true validates_format_of :username, :with => /\A[A-Za-z0-9_]+\z/ validates_length_of :username, :maximum => 32 + validates_exclusion_of :username, :in => USERNAME_BLACKLIST validates_inclusion_of :language, :in => AVAILABLE_LANGUAGE_CODES validates_format_of :unconfirmed_email, :with => Devise.email_regexp, :allow_blank => true diff --git a/config/environment.rb b/config/environment.rb index ba4d85c18211a7261770ba419aa28149f04f2e04..fdefe893be1c774d637d26b005ff184526290b10 100644 --- a/config/environment.rb +++ b/config/environment.rb @@ -27,6 +27,10 @@ else RTL_LANGUAGES = [] end +# Blacklist of usernames +USERNAME_BLACKLIST = ['admin', 'administrator', 'hostmaster', 'info', 'postmaster', 'root', 'ssladmin', + 'ssladministrator', 'sslwebmaster', 'sysadmin', 'webmaster', 'support', 'contact'] + # Initialize the rails application Diaspora::Application.initialize! diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 977df19d6da057373e73b010373f4d8d8edc8bd1..2138a7e73ea05b380e7b5c2414bcf1da91bc9f43 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -151,6 +151,13 @@ describe User do alice.username = "hexagooooooooooooooooooooooooooon" alice.should_not be_valid end + + it "cannot be one of the blacklist names" do + ['hostmaster', 'postmaster', 'root', 'webmaster'].each do |username| + alice.username = username + alice.should_not be_valid + end + end end describe "of email" do