From: Craig Andrews <candrews@integralblue.com>
Date: Fri, 18 Sep 2009 21:53:06 +0000 (-0400)
Subject: Blacklist all files and directories in the web root (INSTALLDIR). Much more elegant... 
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=15f9c80c28042a5f9d51ec8444e3c9c475360481;p=quix0rs-gnu-social.git

Blacklist all files and directories in the web root (INSTALLDIR). Much more elegant than manually keep tracking of these invalid usernames.
---

diff --git a/classes/User.php b/classes/User.php
index 14d3cf54fa..8386f1e185 100644
--- a/classes/User.php
+++ b/classes/User.php
@@ -120,11 +120,15 @@ class User extends Memcached_DataObject
     function allowed_nickname($nickname)
     {
         // XXX: should already be validated for size, content, etc.
-        static $blacklist = array('rss', 'xrds', 'doc', 'main',
-                                  'settings', 'notice', 'user',
-                                  'search', 'avatar', 'tag', 'tags',
-                                  'api', 'message', 'group', 'groups',
-                                  'local');
+
+        $blacklist = array();
+
+        //all directory and file names should be blacklisted
+        $d = dir(INSTALLDIR);
+        while (false !== ($entry = $d->read())) {
+            $blacklist[]=$entry;
+        }
+        $d->close();
         $merged = array_merge($blacklist, common_config('nickname', 'blacklist'));
         return !in_array($nickname, $merged);
     }