1012: strange characters in usernames allowed that later break rendering

kim***@gmai***** (Google Code) (Is this you? Claim this profile.)
July 16, 2009
ReviewBoard allows users to create usernames that it can't handle later on.

I had a user that had already signed up before, and then probably by
mistake they created their account again with a space in front of it.  This
later caused problems on other pages when their account was assigned as a
target reviewer.

I saw the same problem earlier when we created accounts that our included
our email address: joe.user@company.com .  I was able to work around this
by tweaking the LDAP string so that the domain name was not needed, but
ReviewBoard should not allow such names in the first place if it is unable
to render them.

At the very least it needs to strip leading and trailing whitespace!

What's the URL of the page containing the problem?

/r/92/

What steps will reproduce the problem?
1. Create a username with a space or @: ' joe.user' or 'joe.user@company.com'
2. Assign that user to a review request
3. Now view the review-- it will output an exception

What is the expected output? What do you see instead?

Expected output is the review page, instead it crashes.

What operating system are you using? What browser?

Linux & Firefox.

Please provide any additional information below.

TemplateSyntaxError at /r/92/

Caught an exception while rendering: Reverse for 'reviewboard.user' with
arguments '(<User:  joe.user>,)' and keyword arguments '{}' not found.

Request Method: GET    
Request URL:    http://<hostname>:8080/r/92/  
Exception Type: TemplateSyntaxError    
Exception Value:        Caught an exception while rendering: Reverse for
'reviewboard.user' with arguments '(<User:  joe.user>,)' and keyword
arguments '{}' not found.     
Exception Location:    
/usr/local/lib64/python2.6/site-packages/django/template/debug.py in
render_node, line 81      
Python Executable:      /usr/bin/python
Python Version: 2.6.0  
Python Path:    ['/srv/www/reviews/conf',
'/usr/local/lib64/python2.6/site-packages/ReviewBoard-1.0alpha4-py2.6.egg',
'/usr/local/lib64/python2.6/site-packages/flup-1.0.1-py2.6.egg',
'/usr/local/lib64/python2.6/site-packages/Djblets-0.5alpha3-py2.6.egg',
'/usr/local/lib64/python2.6/site-packages/django_evolution-0.0.0-py2.6.egg', '/usr/local/lib64/python2.6/site-packages/python_memcached-1.43-py2.6.egg',
'/usr/local/lib64/python2.6/site-packages/Pygments-1.0-py2.6.egg',
'/usr/local/lib64/python2.6/site-packages/simplejson-2.0.9-py2.6-linux-x86_64.egg',
'/usr/lib64/python2.6/site-packages', '/usr/lib/python26.zip',
'/usr/lib64/python2.6', '/usr/lib64/python2.6/plat-linux2',
'/usr/lib64/python2.6/lib-tk', '/usr/lib64/python2.6/lib-old',
'/usr/lib64/python2.6/lib-dynload',
'/usr/lib64/python2.6/site-packages/Numeric',
'/usr/local/lib64/python2.6/site-packages',
'/usr/local/lib64/python2.6/site-packages/PIL',
'/usr/lib64/python2.6/site-packages/gtk-2.0']   
Server time:    Tue, 31
chipx86
#1 chipx86
  • +Confirmed
  • +Milestone-Release1.0
    +Component-Accounts
chipx86
#2 chipx86
Actually, we're going to push this to 1.1.
  • -Milestone-Release1.0
    +Milestone-Release1.1
chipx86
#3 chipx86
Actually, looks like we had this working fine in 1.0.
  • -Confirmed
    +Fixed
  • -Milestone-Release1.1
    +Milestone-Release1.0