[Zope-CMF] Usernames and spaces

[Tres Seaver]

Grootel, Marc van wrote:

> Hi,
> 
> I've worked with Zope and CMF (btw great stuff) for a while now and did 
> never come across this issue. 
> 
> It is probably not legal to do so but i created a username that has
> spaces. Logged on to it and everything seemed to work fine.
> I could add CMF documents, folders etc, access them through WebDAV
> etc. Nothing wrong with it.
> 
> Then i connected using FTP and saw the files and folders added through
> that account had a part of their creation timestamp prefixed to the id
> (names like "18 16:32 test" instead of "test").
> 
> Probably they are not really there since from the browser everything looks
> fine.
> 
> My first thought was i cut myself on the bleeding edge but then i checked
> and created another account without the spaces and the problem was gone.
> 
> I know creating usernames with spaces is probably not a wise idea anyway
> but since everything was working i saw no harm in it, only FTP seems to
> suffer
> from the problemn (afaiks).
> 
> Should there be a warning when trying to create such accounts or is this
> a real bug?

Both.  The registration tool is responsible for enforcing a particular
site's policies for valid account IDs and passwords, via its
'isMemberIdAllowed' and 'testPasswordValidity' methods.  It doesn't
appear from examination that the 'isMemberIdAllowed' of the CMFDefault
registration tool would permit such an ID, so perhaps the bug is that
the registration process is bypassing the check.

Please file this as a tracker issue:

   http://www.zope.org/Products/PTK/Tracker


-- 
===============================================================
Tres Seaver                                tseaver@zope.com
Zope Corporation      "Zope Dealers"       http://www.zope.com