{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/7158","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7158/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7158/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7158/events","html_url":"https://github.com/joomla/joomla-cms/issues/7158","id":87658516,"number":7158,"title":"inadequate filtering of user-name during installation process","user":{"login":"FrankyDE","id":1822359,"avatar_url":"https://avatars.githubusercontent.com/u/1822359?v=3","gravatar_id":"","url":"https://api.github.com/users/FrankyDE","html_url":"https://github.com/FrankyDE","followers_url":"https://api.github.com/users/FrankyDE/followers","following_url":"https://api.github.com/users/FrankyDE/following{/other_user}","gists_url":"https://api.github.com/users/FrankyDE/gists{/gist_id}","starred_url":"https://api.github.com/users/FrankyDE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FrankyDE/subscriptions","organizations_url":"https://api.github.com/users/FrankyDE/orgs","repos_url":"https://api.github.com/users/FrankyDE/repos","events_url":"https://api.github.com/users/FrankyDE/events{/privacy}","received_events_url":"https://api.github.com/users/FrankyDE/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-12T08:36:47Z","updated_at":"2015-06-12T13:10:52Z","closed_at":null,"body":"#### Steps to reproduce the issue\r\n\r\nInstall Joomla! and use in the user-name a \"forbidden character like:\r\n< > \\ \" ' % ; ( ) &\r\n\r\nIn my case the credentials where:\r\nAdmin-User:\tS9nFA7N7x7tL}jXOJqIx&vQk3jSF\r\nJAdmin-Pass:\tmsevXL0Stl,BV7szpufhMwo10^IV8SRs\r\n\r\nIn the installation process this user/password combination was accepted, installation went fine, but one could not log-in any more. \r\n\r\nAfter I changed the username in the Database login was possible again.\r\n\r\n\r\n#### Expected result\r\n\r\nI would expect that during installation there would be a warning, that prevented me from choosing an username that renders the Superadministrator Login useless. Like the one that is used if one registers a new user in the backend.\r\n\r\n#### Actual result\r\n\r\nInstallation with unusable username is possible. Therefore creating a not usable SuperAdmin account on installation\r\n\r\n#### System information (as much as possible)\r\n\r\n\r\nPHP Built On: Linux server11729.yco.de 3.2.0-4-amd64 #1 SMP Debian 3.2.65-1+deb7u1 x86_64\r\nDatabase Version: 5.5.42-MariaDB-1~wheezy-log\r\nDatabase Collation: utf8_general_ci\r\nPHP Version: 5.4.39-0+deb7u2\r\nWeb Server: Apache\r\nWebServer to PHP Interface: cgi-fcgi\r\nJoomla! Version: Joomla! 3.4.1 Stable [ Ember ] 21-March-2015 20:30 GMT\r\nJoomla! Platform Version: Joomla Platform 13.1.0 Stable [ Curiosity ] 24-Apr-2013 00:00 GMT\r\nUser Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0 \r\n\r\n#### Additional comments\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/111486151","html_url":"https://github.com/joomla/joomla-cms/issues/7158#issuecomment-111486151","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7158","id":111486151,"user":{"login":"mbabker","id":368545,"avatar_url":"https://avatars.githubusercontent.com/u/368545?v=3","gravatar_id":"","url":"https://api.github.com/users/mbabker","html_url":"https://github.com/mbabker","followers_url":"https://api.github.com/users/mbabker/followers","following_url":"https://api.github.com/users/mbabker/following{/other_user}","gists_url":"https://api.github.com/users/mbabker/gists{/gist_id}","starred_url":"https://api.github.com/users/mbabker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbabker/subscriptions","organizations_url":"https://api.github.com/users/mbabker/orgs","repos_url":"https://api.github.com/users/mbabker/repos","events_url":"https://api.github.com/users/mbabker/events{/privacy}","received_events_url":"https://api.github.com/users/mbabker/received_events","type":"User","site_admin":false},"created_at":"2015-06-12T13:10:52Z","updated_at":"2015-06-12T13:10:52Z","body":"It has nothing to do with the JForm validation (which is what the first link points to).  The install app doesn't use the JTable classes to insert data, so the check in JTableUser will never be reached.\r\n\r\nAt a quick glance, enough of the app might be in place to be able to use JTable to insert the super user (and inherently run its validations), but it may also still be a long shot."}}