Verify 'Full Name' field does not allow HTML in Signup form

'Full Name' field in the signup form is allowing HTML as an input
which makes spoofing easily.To avoid it, validation is added
that will ensure 'Full Name' field does not allow HTML.

LEARNER-3385
This commit is contained in:
uzairr
2017-12-06 14:58:17 +00:00
parent 979c7cd1f0
commit 8ffac2061d
5 changed files with 36 additions and 12 deletions

View File

@@ -128,6 +128,16 @@ def validate_username(username):
validator(username)
def validate_name(name):
"""
Verifies a Full_Name is valid, raises a ValidationError otherwise.
Args:
name (unicode): The name to validate.
"""
if accounts_settings.api.contains_html(name):
raise forms.ValidationError(_('Full Name cannot contain the following characters: < >'))
class UsernameField(forms.CharField):
"""
A CharField that validates usernames based on the `ENABLE_UNICODE_USERNAME` feature.
@@ -192,7 +202,8 @@ class AccountCreationForm(forms.Form):
error_messages={
"required": _NAME_TOO_SHORT_MSG,
"min_length": _NAME_TOO_SHORT_MSG,
}
},
validators=[validate_name]
)
def __init__(