Item11501: User registration needs mechanism to validate form fields

See SecurityAlert-CVE-2012-1004 for important information about this task

The form fields submitted during registration other than those validated as part of the registration process - FirstName, LastName, Login name, wikiname, etc. are not validated.

This is really an enhancement, but is marked urgent.

• add a validateRegistrationField function to Users.pm
  • Called with fieldname, fieldvalue
  • Returns sanitized field, or can throw oops.
• Provide basic validation in Users.pm if not implemented in the mapper.

Register.pm should call this routine for each field in the query prior to allowing the registration to proceed.

-- GeorgeClark - 03 Feb 2012

See also: Support.SecurityAlert-CVE-2012-1004, and Item11498

-- PaulHarvey - 04 Feb 2012

Commenting is disabled while not logged in