More username restrictions

app.py

@@ -350,33 +350,42 @@ def login():

                                
                                
                                
                            
                                
                                    
                                        
                                            350  
                                                        name = flask.request.form.get("name")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            351  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            352  
                                                        if not only_chars(username,
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        353 -
                                                                      "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_"):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        353 +
                                                                      "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-"):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            354  
                                                            flask.flash(Markup(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        355 -
                                                                _("Usernames may only contain Latin alphabet, numbers, '-' and '_'")),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        355 +
                                                                _("Usernames may only contain Latin alphabet, numbers and '-'")),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        356 +
                                                                category="error")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        357 +
                                                        return flask.render_template("login.html")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        358 +
                                                    if "--" in username:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        359 +
                                                        flask.flash(Markup(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        360 +
                                                                _("Usernames may not contain consecutive hyphens")),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            361  
                                                                    category="error")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            362  
                                                            return flask.render_template("login.html")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        358 -
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            363  
                                                        if username in config.RESERVED_NAMES:
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            364  
                                                            flask.flash(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            365  
                                                                    Markup(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        362 -
                                                                        "<iconify-icon icon='mdi:account-error'></iconify-icon>" + _(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        363 -
                                                                                "Sorry, {username} is a system path").format(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        366 +
                                                                        _("Sorry, {username} is a system path").format(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            367  
                                                                                    username=username)),
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            368  
                                                                    category="error")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            369  
                                                            return flask.render_template("login.html")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            370  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        371 +
                                                    if not username.islower():
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        372 +
                                                        username = username.lower()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        373 +
                                                        flask.flash(Markup(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        374 +
                                                                _("Usernames must be lowercase, so it's been converted automatically")),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        375 +
                                                                category="info")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        376 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            377  
                                                        user_check = User.query.filter_by(username=username).first()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            378  
                                                        if user_check or email2:  # make the honeypot look like a normal error
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            379  
                                                            flask.flash(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            380  
                                                                    Markup(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        372 -
                                                                        "<iconify-icon icon='mdi:account-error'></iconify-icon>" + _(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        381 +
                                                                        _(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            382  
                                                                                    "The username {username} is taken").format(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            383  
                                                                                    username=username)),
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            384  
                                                                    category="error")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            385  
                                                            return flask.render_template("login.html")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            386  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            387  
                                                        if password2 != password:
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        379 -
                                                        flask.flash(Markup("<iconify-icon icon='mdi:key-alert'></iconify-icon>" + _(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        388 +
                                                        flask.flash(Markup(_(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            389  
                                                                    "Make sure the passwords match")),
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            390  
                                                                        category="error")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            391  
                                                            return flask.render_template("login.html")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -386,10 +395,10 @@ def login():

                                
                                
                                
                            
                                
                                    
                                        
                                            395  
                                                        db.session.commit()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            396  
                                                        flask.session["username"] = user.username
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            397  
                                                        flask.flash(Markup(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        389 -
                                                            "<iconify-icon icon='mdi:account'></iconify-icon>" + _(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        390 -
                                                                    "Successfully created and logged in as {username}").format(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        391 -
                                                                    username=username)),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        392 -
                                                            category="success")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        398 +
                                                                    _(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        399 +
                                                                        "Successfully created and logged in as {username}").format(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        400 +
                                                                        username=username)),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        401 +
                                                                category="success")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            402  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            403  
                                                        notification = Notification({"type": "welcome"})
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            404  
                                                        db.session.add(notification)