Add ':' to $wgInvalidUsernameCharacters

This will prevent the creation of new users with a colon character
in their username. Existing accounts or system users will not be affected.

Colons themselves are not an issue, however they are used as the delimiter
for namespaces and interwikis. In a global account type system where there
are wikis with multiple languages, usernames that begin with a localized
namespace prefix will be invalid on some wikis and not others, which is
problematic. Preventing the usage of colons avoids that issue entirely.

Bug: T98757
Change-Id: I3c823325e209b2c48c1eee1fbc82a130c768cd2c

diff --git a/RELEASE-NOTES-1.26 b/RELEASE-NOTES-1.26
index 8cb7503..3d6651f 100644 (file)
--- a/RELEASE-NOTES-1.26
+++ b/RELEASE-NOTES-1.26
@@ -13,6 +13,8 @@ production.
 === New features in 1.26 ===
 * Change tags can now be hidden in the interface by disabling the associated
   "tag-<id>" interface message.
+* ':' (colon) is now invalid in usernames for new accounts. Existing accounts
+  are not affected.
 
 ==== External libraries ====
 

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 31724f6..857d69e 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -4438,7 +4438,7 @@ $wgHiddenPrefs = array();
  * This is used in a regular expression character class during
  * registration (regex metacharacters like / are escaped).
  */
-$wgInvalidUsernameCharacters = '@';
+$wgInvalidUsernameCharacters = '@:';
 
 /**
  * Character used as a delimiter when testing for interwiki userrights