From 428e898a7ac299303737fb97ac91e02a74fa5640 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erich=20Mauerb=C3=B6ck?=
 <9578115+Enrice@users.noreply.github.com>
Date: Fri, 3 Nov 2023 15:36:02 +0100
Subject: [PATCH] allow hyphen in username (#731)

* allow hyphen in username

* remove extra escaping

---------

Co-authored-by: Enrice <erich.mauerboeck@ergo-versicherung.at>
---
 .../main/java/com/sismics/rest/util/ValidationUtil.java   | 2 +-
 .../com/sismics/docs/rest/resource/GroupResource.java     | 2 +-
 .../java/com/sismics/docs/rest/resource/UserResource.java | 8 ++++----
 .../main/webapp/src/partial/docs/settings.user.edit.html  | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs-web-common/src/main/java/com/sismics/rest/util/ValidationUtil.java b/docs-web-common/src/main/java/com/sismics/rest/util/ValidationUtil.java
index a1fc68314..cebf1f27d 100644
--- a/docs-web-common/src/main/java/com/sismics/rest/util/ValidationUtil.java
+++ b/docs-web-common/src/main/java/com/sismics/rest/util/ValidationUtil.java
@@ -21,7 +21,7 @@ public class ValidationUtil {
     
     private static Pattern ALPHANUMERIC_PATTERN = Pattern.compile("[a-zA-Z0-9_]+");
     
-    private static Pattern USERNAME_PATTERN = Pattern.compile("[a-zA-Z0-9_@\\.]+");
+    private static Pattern USERNAME_PATTERN = Pattern.compile("[a-zA-Z0-9_@.-]+");
     
     /**
      * Checks that the argument is not null.
diff --git a/docs-web/src/main/java/com/sismics/docs/rest/resource/GroupResource.java b/docs-web/src/main/java/com/sismics/docs/rest/resource/GroupResource.java
index 982d90a8d..2dd269742 100644
--- a/docs-web/src/main/java/com/sismics/docs/rest/resource/GroupResource.java
+++ b/docs-web/src/main/java/com/sismics/docs/rest/resource/GroupResource.java
@@ -313,7 +313,7 @@ public Response addMember(@PathParam("groupName") String groupName,
      * @return Response
      */
     @DELETE
-    @Path("{groupName: [a-zA-Z0-9_]+}/{username: [a-zA-Z0-9_@\\.]+}")
+    @Path("{groupName: [a-zA-Z0-9_]+}/{username: [a-zA-Z0-9_@.-]+}")
     public Response removeMember(@PathParam("groupName") String groupName,
             @PathParam("username") String username) {
         if (!authenticate()) {
diff --git a/docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java b/docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java
index 9403025bc..841ef25e2 100644
--- a/docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java
+++ b/docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java
@@ -195,7 +195,7 @@ public Response update(
      * @return Response
      */
     @POST
-    @Path("{username: [a-zA-Z0-9_@\\.]+}")
+    @Path("{username: [a-zA-Z0-9_@.-]+}")
     public Response update(
         @PathParam("username") String username,
         @FormParam("password") String password,
@@ -497,7 +497,7 @@ public Response delete() {
      * @return Response
      */
     @DELETE
-    @Path("{username: [a-zA-Z0-9_@\\.]+}")
+    @Path("{username: [a-zA-Z0-9_@.-]+}")
     public Response delete(@PathParam("username") String username) {
         if (!authenticate()) {
             throw new ForbiddenClientException();
@@ -563,7 +563,7 @@ public Response delete(@PathParam("username") String username) {
      * @return Response
      */
     @POST
-    @Path("{username: [a-zA-Z0-9_@\\.]+}/disable_totp")
+    @Path("{username: [a-zA-Z0-9_@.-]+}/disable_totp")
     public Response disableTotpUsername(@PathParam("username") String username) {
         if (!authenticate()) {
             throw new ForbiddenClientException();
@@ -685,7 +685,7 @@ public Response info() {
      * @return Response
      */
     @GET
-    @Path("{username: [a-zA-Z0-9_@\\.]+}")
+    @Path("{username: [a-zA-Z0-9_@.-]+}")
     @Produces(MediaType.APPLICATION_JSON)
     public Response view(@PathParam("username") String username) {
         if (!authenticate()) {
diff --git a/docs-web/src/main/webapp/src/partial/docs/settings.user.edit.html b/docs-web/src/main/webapp/src/partial/docs/settings.user.edit.html
index 2cf9f6e91..f4b1f5398 100644
--- a/docs-web/src/main/webapp/src/partial/docs/settings.user.edit.html
+++ b/docs-web/src/main/webapp/src/partial/docs/settings.user.edit.html
@@ -9,7 +9,7 @@ <h2 ng-show="!isEdit()" translate="settings.user.edit.add_user_title"></h2>
       <label class="col-sm-2 control-label" for="inputUserUsername">{{ 'settings.user.edit.username' | translate }}</label>
       <div class="col-sm-7">
         <input name="userUsername" type="text" id="inputUserUsername" required ng-disabled="isEdit()" class="form-control"
-               ng-pattern="/^[a-zA-Z0-9_@\.]*$/"
+               ng-pattern="/^[a-zA-Z0-9_@.-]*$/"
                ng-minlength="3" ng-maxlength="50" ng-attr-placeholder="{{ 'settings.user.edit.username' | translate }}" ng-model="user.username"/>
       </div>