prevent users from registering with name that is not a valid wikifile

avoids XSS attacks and is generally a good limitation

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 36d0e60082896e81fb8a16908edc208f74362869..067886c70d49c1eed93865b8f867584a73a06605 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -118,6 +118,7 @@ sub cgi_signin ($$) { #{{{
                                validate => sub {
                                        my $name=shift;
                                        length $name &&
+                                       $name=~/$wiki_file_regexp/ &&
                                        ! userinfo_get($name, "regdate");
                                },
                        );