From: Evan Prodromou <evan@status.net>
Date: Sun, 1 Nov 2009 16:09:14 +0000 (-0500)
Subject: Revert "Blacklist all files and directories in the web root (INSTALLDIR). Much more... 
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=66645282440d914c899ba63fffd1ee911c0f8879;p=quix0rs-gnu-social.git

Revert "Blacklist all files and directories in the web root (INSTALLDIR). Much more elegant than manually keep tracking of these invalid usernames."

This reverts commit 15f9c80c28042a5f9d51ec8444e3c9c475360481.

So, so, elegant! And so, so, incorrect!

We can't have a user named 'notice' because that would interfere with
URLs like /notice/1234. However, there is no file named 'notice' in
the Web root.

If there were a way to automatically pull out the virtual paths in the
root dir, this may make sense. Until then, we keep track here.
---

diff --git a/classes/User.php b/classes/User.php
index 007662131c..7ab9f307ae 100644
--- a/classes/User.php
+++ b/classes/User.php
@@ -120,15 +120,11 @@ class User extends Memcached_DataObject
     function allowed_nickname($nickname)
     {
         // XXX: should already be validated for size, content, etc.
-
-        $blacklist = array();
-
-        //all directory and file names should be blacklisted
-        $d = dir(INSTALLDIR);
-        while (false !== ($entry = $d->read())) {
-            $blacklist[]=$entry;
-        }
-        $d->close();
+        static $blacklist = array('rss', 'xrds', 'doc', 'main',
+                                  'settings', 'notice', 'user',
+                                  'search', 'avatar', 'tag', 'tags',
+                                  'api', 'message', 'group', 'groups',
+                                  'local');
         $merged = array_merge($blacklist, common_config('nickname', 'blacklist'));
         return !in_array($nickname, $merged);
     }