Username consisting entirely of special characters causes profile links to break

[niftythree]

Hi,

When registering a username which consists only of special characters (example @-@-), the registration proceeds and the user account can be activated. However, the profile link is non-existent, so the user cannot do anything with their account through the web interface when logged in (their account links will 404). Other users and admins (from the web frontend) cannot access the new profile either, because they'll end up going to /members/ when they click on the profile.

This is also reflected in the output of the REST API. For example, some plugins are not exposed via the REST API. To get around this limitation, our app uses the user profile link (as provided by the REST API members endpoint) to open a web browser and redirect them to the website. This allows users to access specific functions, such as exporting their profile data. However, they are not able to access these functions because the link is invalid.

Perhaps, in this situation, making it a requirement to have at least one letter or number in the username field would prevent this? Or even having it so no special characters are allowed? We also note that the View User link (top bar) when viewing an account with a username like this (e.g. @-@-) in the admin backend is also blank (/author/). We do know there is a link between BuddyPress and WordPress regarding usernames, but we are unsure of the extent of this.

Thanks.

[espellcaste]

I think we can support this use case better. I'll take a look.

Trac ticket: ​https://buddypress.trac.wordpress.org/ticket/8781

[espellcaste]

making it a requirement to have at least one letter or number in the username field would prevent this?

I agree with this. Added a pull request with this + unit tests. Having an username with @-@- is not desirable, IMO.

[espellcaste]

In 13985:

Enforce requirement of usernames having valid letters.

Profile links do not work for users with usernames that do not contain any valid letters. We have logic in place to check for letters but it is faulty. This commit enforces the requirement that usernames must contain a minimum of 4 and a maximum of 60 characters, with valid letters.

It comes with unit tests and includes some minor coding styles fixes.

Commit to correct the one previously sent at [13984]

Props niftythree.

Fixes #8781
Closes ​https://github.com/buddypress/buddypress/pull/332/