On Wed, Jul 20, 2016 at 01:11:38AM +0000, John Rouillard wrote:
> 
> John Rouillard added the comment:
> 
> Login name of <b>demo</b> is allowed. Probably should restrict
> login name to match [A-z0-9_.-]+ (C locale).
> 
> Although we do html encode things, probably better to sanitize
> the login name at least.

Good idea to limit the chars we allow in usernames.
Please allow "@", I have a tracker where we use the email address as
username (and authenticate against an IMAP server) for a simple helpdesk
application.

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: office@runtux.com