From 0b7f4c134cd26d3de2a0b0bc38ee54092590995c Mon Sep 17 00:00:00 2001
From: Kevin Boxhoorn <kevinboxhoorn@yahoo.com>
Date: Mon, 17 Oct 2016 21:24:42 +1100
Subject: [PATCH] Disallow usernames that contain certain words and RegExp
 (#2200)

* Add `disallowedwords` setting and perform check

Check if any of the words in `disallowedwords` are contained in the username. If
so, return false like other checks.

NOTE: Needs testing for advanced bugs.

* Remove "administrator" from `disallowedwords`

"administrator" contains "admin" anyway, so it is not needed.

* Add error message if username contains a disallowed word

* Add `disallowedregexp` setting and perform check

Check if each expression in `disallowedregexp` exactly matches the username. If
so, return false.

TODO: Add specific error to dialog in `window_main.cpp`.

* Add error message for username matching RegExp

* Fix indentation

* Compile `disallowedregexp` into a QList upon initialization

Reduces system load with each registration request.

* Clean up `isUsernameValid` function

* Fix indentation

* Add backwards compatibility to client

Client can accept either 7 or 9 rules to maintain compatibility with older
versions of server.

* Add examples and warnings to `servatrice.ini`
---
 cockatrice/src/window_main.cpp                   | 16 +++++++++++++---
 servatrice/servatrice.ini.example                | 12 ++++++++++++
 servatrice/src/servatrice_database_interface.cpp | 15 ++++++++++++++-
 servatrice/src/settingscache.cpp                 | 10 +++++++---
 servatrice/src/settingscache.h                   |  3 +++
 5 files changed, 49 insertions(+), 7 deletions(-)

diff --git a/cockatrice/src/window_main.cpp b/cockatrice/src/window_main.cpp
index 5c1b97b5..4db0895f 100644
--- a/cockatrice/src/window_main.cpp
+++ b/cockatrice/src/window_main.cpp
@@ -404,9 +404,9 @@ QString MainWindow::extractInvalidUsernameMessage(QString & in)
 {
     QString out = tr("Invalid username.") + "<br/>";
     QStringList rules = in.split(QChar('|'));
-    if (rules.size() == 7)
+    if (rules.size() == 7 || rules.size() == 9)
     {
-        out += tr("Your username must respect these rules:") + "<br><ul>";
+        out += tr("Your username must respect these rules:") + "<ul>";
 
         out += "<li>" + tr("is %1 - %2 characters long").arg(rules.at(0)).arg(rules.at(1)) + "</li>";
         out += "<li>" + tr("can %1 contain lowercase characters").arg((rules.at(2).toInt() > 0) ? "" : tr("NOT")) + "</li>";
@@ -417,6 +417,16 @@ QString MainWindow::extractInvalidUsernameMessage(QString & in)
             out += "<li>" + tr("can contain the following punctuation: %1").arg(rules.at(6).toHtmlEscaped()) + "</li>";
 
         out += "<li>" + tr("first character can %1 be a punctuation mark").arg((rules.at(5).toInt() > 0) ? "" : tr("NOT")) + "</li>";
+
+        if (rules.size() == 9)
+        {
+            if (rules.at(7).size() > 0)
+                out += "<li>" + tr("can not contain any of the following words: %1").arg(rules.at(7).toHtmlEscaped()) + "</li>";
+
+            if (rules.at(8).size() > 0)
+                out += "<li>" + tr("can not match any of the following expressions: %1").arg(rules.at(8).toHtmlEscaped()) + "</li>";
+        }
+
         out += "</ul>";
     }
     else
@@ -527,7 +537,7 @@ void MainWindow::retranslateUi()
     dbMenu->setTitle(tr("C&ard Database"));
     aOpenCustomFolder->setText(tr("Open custom image folder"));
     aOpenCustomsetsFolder->setText(tr("Open custom sets folder"));
-    aAddCustomSet->setText(tr("Add custom sets/cards"));    
+    aAddCustomSet->setText(tr("Add custom sets/cards"));
     aEditSets->setText(tr("&Edit sets..."));
     aEditTokens->setText(tr("Edit &tokens..."));
 
diff --git a/servatrice/servatrice.ini.example b/servatrice/servatrice.ini.example
index 466810d7..42013783 100644
--- a/servatrice/servatrice.ini.example
+++ b/servatrice/servatrice.ini.example
@@ -107,6 +107,18 @@ allowedpunctuation=_.-
 ; If a username can begin with punctuation defined in allowedpunctuation
 allowpunctuationprefix=false
 
+; Disallow usernames containing these words. This list is comma seperated, e.g.
+; "admin,user,name"
+disallowedwords="admin"
+
+; Disallow usernames matching these regular expressions. This list is comma
+; separated, e.g. "\\w+\\d+,\\d{2}user", hence you cannot use commas in your
+; expressions. Backslashes must be escaped, so `\w+\d+` becomes `\\w+\\d+`.
+; WARNING: Complex expressions can be harmful to performance. Please make sure
+;          your expressions are considered well formed. See this page for info:
+;          http://www.regular-expressions.info/catastrophic.html
+disallowedregexp=""
+
 [registration]
 
 ; Servatrice can process registration requests to add new users on the fly.
diff --git a/servatrice/src/servatrice_database_interface.cpp b/servatrice/src/servatrice_database_interface.cpp
index 25aa4b6a..d29fddad 100644
--- a/servatrice/src/servatrice_database_interface.cpp
+++ b/servatrice/src/servatrice_database_interface.cpp
@@ -132,7 +132,12 @@ bool Servatrice_DatabaseInterface::usernameIsValid(const QString &user, QString
     bool allowNumerics = settingsCache->value("users/allownumerics", true).toBool();
     bool allowPunctuationPrefix = settingsCache->value("users/allowpunctuationprefix", false).toBool();
     QString allowedPunctuation = settingsCache->value("users/allowedpunctuation", "_").toString();
-    error = QString("%1|%2|%3|%4|%5|%6|%7").arg(minNameLength).arg(maxNameLength).arg(allowLowercase).arg(allowUppercase).arg(allowNumerics).arg(allowPunctuationPrefix).arg(allowedPunctuation);
+    QString disallowedWordsStr = settingsCache->value("users/disallowedwords", "").toString();
+    QStringList disallowedWords = disallowedWordsStr.split(",", QString::SkipEmptyParts);
+    disallowedWords.removeDuplicates();
+    QString disallowedRegExpStr = settingsCache->value("users/disallowedregexp", "").toString();
+
+    error = QString("%1|%2|%3|%4|%5|%6|%7|%8|%9").arg(minNameLength).arg(maxNameLength).arg(allowLowercase).arg(allowUppercase).arg(allowNumerics).arg(allowPunctuationPrefix).arg(allowedPunctuation).arg(disallowedWordsStr).arg(disallowedRegExpStr);
 
     if (user.length() < minNameLength || user.length() > maxNameLength)
         return false;
@@ -140,6 +145,14 @@ bool Servatrice_DatabaseInterface::usernameIsValid(const QString &user, QString
     if (!allowPunctuationPrefix && allowedPunctuation.contains(user.at(0)))
         return false;
 
+    for (const QString &word : disallowedWords) {
+        if (user.contains(word, Qt::CaseInsensitive)) return false;
+    }
+
+    for (const QRegExp &regExp : settingsCache->disallowedRegExp) {
+        if (regExp.exactMatch(user)) return false;
+    }
+
     QString regEx("[");
     if (allowLowercase)
         regEx.append("a-z");
diff --git a/servatrice/src/settingscache.cpp b/servatrice/src/settingscache.cpp
index 5569d5af..5009365b 100644
--- a/servatrice/src/settingscache.cpp
+++ b/servatrice/src/settingscache.cpp
@@ -4,14 +4,18 @@
 #include <QStandardPaths>
 
 SettingsCache::SettingsCache(const QString & fileName, QSettings::Format format, QObject * parent)
-:QSettings(fileName, format, parent)
+    :QSettings(fileName, format, parent)
 {
-
+    QStringList disallowedRegExpStr = value("users/disallowedregexp", "").toString().split(",", QString::SkipEmptyParts);
+    disallowedRegExpStr.removeDuplicates();
+    for (const QString &regExpStr : disallowedRegExpStr) {
+        disallowedRegExp.append(QRegExp(regExpStr));
+    }
 }
 
 QString SettingsCache::guessConfigurationPath(QString & specificPath)
 {
-    const QString fileName="servatrice.ini";    
+    const QString fileName="servatrice.ini";
     #ifdef PORTABLE_BUILD
     return fileName;
     #endif
diff --git a/servatrice/src/settingscache.h b/servatrice/src/settingscache.h
index 7284d273..75e0a86f 100644
--- a/servatrice/src/settingscache.h
+++ b/servatrice/src/settingscache.h
@@ -3,6 +3,8 @@
 
 #include <QSettings>
 #include <QString>
+#include <QList>
+#include <QRegExp>
 
 class SettingsCache : public QSettings {
     Q_OBJECT
@@ -11,6 +13,7 @@ private:
 public:
     SettingsCache(const QString & fileName="servatrice.ini", QSettings::Format format=QSettings::IniFormat, QObject * parent = 0);
     static QString guessConfigurationPath(QString & specificPath);
+    QList<QRegExp> disallowedRegExp;
 };
 
 extern SettingsCache *settingsCache;