[pmg-devel] applied: [PATCH pmg-api v2] utils: user schema: explicitly forbid @ in user-names

[Thomas Lamprecht]

Am 26.02.25 um 21:58 schrieb Stoiko Ivanov:
> PMGs terms are:
> * 'userid' consists of 'username'@'realm'
> 
> without this patch it was possible to create a user through the api,
> with @ in the username ('foo at bar@pmg'), and it got written to the
> user-conf.
> Reading that entry was not possible, as the verification on read was
> stricter.
> 
> This patch forbids '@' in usernames, and additionally drops the
> maxLength of 64, as 60 are already enforced by the regex pattern match
> (leaving 4 as minimal length for '@pmg'/'@pam').
> 
> Potential for regression should be minimal (the users could not be
> read-back from the config).
> 
> Signed-off-by: Stoiko Ivanov <s.ivanov at proxmox.com>
> ---
> minimally tested on top of latest master
> - 128 character username
> - a at a@pmg
> both failing
> - 60 character username at pmg - succeeds
>  src/PMG/Utils.pm | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
>

applied, thanks!