Added backend and frontend validation for username registration

lib/addons/memcached/index.js

@@ -53,7 +53,10 @@ module.exports = function(app, connection) {
 
     // Removes user data from old cookies
     var username = undefsafe(req, 'session.user.name');
-    var key = username.replace(' ', '^^');
+    var key;
+    if (username !== undefined) {
+      key = username.replace(' ', '^^');
+    }
 
     var setUserMetadata = setMetadata.bind(null, req);
     var populateUserMetadata = getMetadata.bind(null, username, req, key);

lib/handlers/user.js

@@ -47,6 +47,18 @@ module.exports = Observable.extend({
       return next();
     }
 
+    var reg = /^[a-zA-Z0-9_\-]+$/;
+    if (!reg.test(username)) {
+      req.error = {
+        ok: false,
+        message: 'Only numbers, letters, underscore and dash are allowed in the username',
+        raw: 'Character not allowed',
+        status: 400
+      };
+
+      return next();
+    }
+
     userModel.load(username, function (err, result) {
       if (result) {
         // Username taken

views/register-login.html

@@ -15,7 +15,7 @@
   <form action="{{root}}/register" method="post" class="register">
     <div>
       <label for="signup-username">Username</label>
-      <input name="username" id="signup-username" type="text" required>
+      <input name="username" id="signup-username" type="text" required pattern="[a-zA-Z0-9_\-]+" oninvalid="setCustomValidity('Only numbers, letters, underscore and dash are allowed in the username')">
     </div>
     <div>
       <label for="signup-email">Email address</label>