From 77dcb8591250d451b8e9ac082cca0f58f78f4976 Mon Sep 17 00:00:00 2001
From: rubenwardy <rw@rubenwardy.com>
Date: Mon, 22 Feb 2021 23:45:20 +0000
Subject: [PATCH] Add username validation to signup page

---
 app/blueprints/users/account.py       |  3 +-
 app/templates/users/claim_forums.html | 47 +++++++++------------------
 app/templates/users/register.html     |  4 +--
 requirements.lock.txt                 |  1 -
 utils/start.sh                        |  2 +-
 5 files changed, 20 insertions(+), 37 deletions(-)

diff --git a/app/blueprints/users/account.py b/app/blueprints/users/account.py
index c996541..e7da0b5 100644
--- a/app/blueprints/users/account.py
+++ b/app/blueprints/users/account.py
@@ -100,7 +100,8 @@ def logout():
 
 
 class RegisterForm(FlaskForm):
-	username = StringField("Username", [InputRequired()])
+	username = StringField("Username", [InputRequired(),
+			Regexp("^[a-zA-Z0-9._ -]+$", message="Only a-zA-Z0-9._ allowed")])
 	email = StringField("Email", [InputRequired(), Email()])
 	password = PasswordField("Password", [InputRequired(), Length(6, 100)])
 	submit = SubmitField("Register")
diff --git a/app/templates/users/claim_forums.html b/app/templates/users/claim_forums.html
index 9e02ac0..a79813f 100644
--- a/app/templates/users/claim_forums.html
+++ b/app/templates/users/claim_forums.html
@@ -5,22 +5,22 @@ Create Account from Forums User
 {% endblock %}
 
 {% block content %}
-	<h1>{{ self.title() }}</h1>
+<h1>{{ self.title() }}</h1>
 
-	<h2>{{ _("Confirm Your Account") }}</h2>
+<h2>{{ _("Confirm Your Account") }}</h2>
 
-	<p>
-		You'll need to use prove that you have access to your forum account using one of the options below.<br>
-		This is so ContentDB can link your account to your forum account.
-	</p>
+<p>
+	You'll need to use prove that you have access to your forum account using one of the options below.<br>
+	This is so ContentDB can link your account to your forum account.
+</p>
 
-	<p>
-		Don't have a forums account?
-		You can still <a href="{{ url_for('users.register') }}">sign up without one</a>.
-	</p>
+<p>
+	Don't have a forums account?
+	You can still <a href="{{ url_for('users.register') }}">sign up without one</a>.
+</p>
 
-	<div class="row mt-5">
-		<div class="col-sm-6">
+<div class="row mt-5">
+	<div class="col-sm-6">
 		<div class="card">
 			<div class="card-header">
 				<span class="badge badge-pill badge-dark mr-2">Option 1</span>
@@ -48,9 +48,9 @@ Create Account from Forums User
 				<input class="btn btn-primary" type="submit" value="Next: log in with GitHub">
 			</form>
 		</div>
-		</div>
+	</div>
 
-		<div class="col-sm-6">
+	<div class="col-sm-6">
 		<div class="card">
 			<div class="card-header">
 				<span class="badge badge-pill badge-dark mr-2">Option 2</span>
@@ -91,23 +91,6 @@ Create Account from Forums User
 				<input class="btn btn-primary" type="submit" value="Next">
 			</form>
 		</div>
-		</div>
-
-{#		<div class="col-sm-4">#}
-{#			<div class="card">#}
-{#				<div class="card-header">#}
-{#					Email/password sign up#}
-{#				</div>#}
-{##}
-{#				<div class="card-body">#}
-{#					<p>#}
-{#						If you have a forum account, please use one of the other two#}
-{#						options.#}
-{#					</p>#}
-{##}
-{#					<a class="btn btn-primary" href="{{ url_for('users.register') }}">Register</a>#}
-{#				</div>#}
-{#			</div>#}
-{#		</div>#}
 	</div>
+</div>
 {% endblock %}
diff --git a/app/templates/users/register.html b/app/templates/users/register.html
index 854c65e..2d617e5 100644
--- a/app/templates/users/register.html
+++ b/app/templates/users/register.html
@@ -7,13 +7,13 @@ Register
 {% block content %}
 {% from "macros/forms.html" import render_field, render_checkbox_field, render_submit_field %}
 
-<div class="card">
+<div class="card w-50 text-left" style="margin: 2em auto;">
 	<h2 class="card-header">{{ _("Register") }}</h2>
 
 	<form action="" method="POST" class="form card-body" role="form">
 		{{ form.hidden_tag() }}
 
-		{{ render_field(form.username) }}
+		{{ render_field(form.username, pattern="[a-zA-Z0-9._ -]+", title="Only a-zA-Z0-9._ allowed") }}
 		{{ render_field(form.email) }}
 		{{ render_field(form.password) }}
 
diff --git a/requirements.lock.txt b/requirements.lock.txt
index 35204ce..7af3d6d 100644
--- a/requirements.lock.txt
+++ b/requirements.lock.txt
@@ -33,7 +33,6 @@ gitdb==4.0.5
 GitHub-Flask==3.2.0
 GitPython==3.1.12
 gunicorn==20.0.4
-idna==3.1
 importlib-metadata==3.4.0
 iniconfig==1.1.1
 itsdangerous==1.1.0
diff --git a/utils/start.sh b/utils/start.sh
index c69b676..4280d04 100755
--- a/utils/start.sh
+++ b/utils/start.sh
@@ -6,4 +6,4 @@
 #   docker-compose directly:  docker-compose up --build
 #
 
-sudo docker-compose up --build -d --scale worker=2
+docker-compose up --build -d --scale worker=2