Verify 'Full Name' field does not allow HTML in Signup form

'Full Name' field in the signup form is allowing HTML as an input
which makes spoofing easily.To avoid it, validation is added
that will ensure 'Full Name' field does not allow HTML.

LEARNER-3385
This commit is contained in:
uzairr
2017-12-06 14:58:17 +00:00
parent 979c7cd1f0
commit 8ffac2061d
5 changed files with 36 additions and 12 deletions

View File

@@ -173,11 +173,15 @@ def update_account_settings(requesting_user, update, username=None):
"user_message": err.message
}
if changing_full_name and contains_html(update['name']):
field_errors["name"] = {
"developer_message": u"Error thrown from validate_full_name: '{}'".format('Full Name is in-valid'),
"user_message": _(u"Full Name cannot contain the following characters: < >")
}
# If the user asked to change full name, validate it
if changing_full_name:
try:
student_forms.validate_name(update['name'])
except ValidationError as err:
field_errors["name"] = {
"developer_message": u"Error thrown from validate_name: '{}'".format(err.message),
"user_message": err.message
}
# If we have encountered any validation errors, return them to the user.
if field_errors: