user/register: restrict username to a-z0-9

Signed-off-by: Florian Pritz <bluewind@xinu.at>

1 files changed, 2 insertions, 2 deletions

diff --git a/application/controllers/user.php b/application/controllers/user.php
index 67c3ccbb7..06ecc50dd 100644
--- a/application/controllers/user.php
+++ b/application/controllers/user.php
@@ -137,8 +137,8 @@ class User extends CI_Controller {
 			$password = $this->input->post("password");
 			$password_confirm = $this->input->post("password_confirm");
 
-			if (!$username) {
-				$error[]= "Invalid username.";
+			if (!$username || !preg_match("/^[a-z0-9]+$/", $username)) {
+				$error[]= "Invalid username (only a-z0-9 are allowed).";
 			}
 
 			$this->load->helper("email");