Tim Abbott b064559652 zephyr: Add strict assertion about username format. ...

This ensures that even if it were possible to create an MIT Kerberos
account with a malicious username and/or hack webathena to pretend
that's the case, one couldn't do anything malicious.

This security improvement only impacts a single installation of Zulip
where Zephyr mirroring is in use that has already had the fix applied,
so there's no reason to do a security notice for it.

Found by Graham Bleaney using pysa.

2020-03-17 05:37:25 -07:00

2.3 KiB

Raw Blame History

View Raw