Block URL unsafe characters from username

git-svn-id: https://code.elgg.org/elgg/trunk@3327 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/engine/lib/users.php b/engine/lib/users.php
index 6b16e5e69462cc3660544949d49331a37fbcfeea..85056269b2d6a335d6e4547f15438e49468dfde6 100644 (file)
--- a/engine/lib/users.php
+++ b/engine/lib/users.php
@@ -1149,7 +1149,10 @@
                        (strpos($username, '\'')!==false) ||\r
                        (strpos($username, '*')!==false) ||\r
                        (strpos($username, '&')!==false) ||\r
-                       (strpos($username, ' ')!==false)\r
+                       (strpos($username, ' ')!==false) ||
+                       (strpos($username, '?')!==false) ||
+                       (strpos($username, '#')!==false) ||
+                       (strpos($username, '%')!==false)\r
                )\r
                        throw new RegistrationException(elgg_echo('registration:invalidchars'));\r
                 \r