From 2e505a05d13f3835da9d37e8d75d0843f0cc16c7 Mon Sep 17 00:00:00 2001
From: Ankit Agarwal <ankit@moodle.com>
Date: Wed, 2 Jan 2013 13:59:31 +0800
Subject: [PATCH] MDL-27884 Implement proper username validation during csv
 import

---
 admin/tool/uploaduser/index.php | 6 +++++-
 lang/en/error.php               | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/admin/tool/uploaduser/index.php b/admin/tool/uploaduser/index.php
index 0d97168d60e..911d26a7e08 100644
--- a/admin/tool/uploaduser/index.php
+++ b/admin/tool/uploaduser/index.php
@@ -285,7 +285,11 @@ if ($formdata = $mform2->is_cancelled()) {
             $userserrors++;
             continue;
         }
-
+        if ($user->username !== clean_param($user->username, PARAM_USERNAME)) {
+            $upt->track('status', get_string('invalidusername', 'error', 'username'), 'error');
+            $upt->track('username', $errorstr, 'error');
+            $userserrors++;
+        }
         if ($existinguser = $DB->get_record('user', array('username'=>$user->username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
             $upt->track('id', $existinguser->id, 'normal', false);
         }
diff --git a/lang/en/error.php b/lang/en/error.php
index 9640c749ecb..06fe926b7e5 100644
--- a/lang/en/error.php
+++ b/lang/en/error.php
@@ -329,6 +329,7 @@ $string['invalidurl'] = 'Invalid URL';
 $string['invaliduser'] = 'Invalid user';
 $string['invaliduserid'] = 'Invalid user id';
 $string['invaliduserfield'] = 'Invalid user field: {$a}';
+$string['invalidusername'] = 'The given username contains invalid characters';
 $string['invalidxmlfile'] = '"{$a}" is not a valid XML file';
 $string['iplookupfailed'] = 'Cannot find geo information about this IP address {$a}';
 $string['iplookupprivate'] = 'Cannot display lookup of private IP address';