diff --git a/api/config/settings/common.py b/api/config/settings/common.py index 077566d1c6a82e329f334a7fe94764cafbd92a70..2c72865f63fa3e8d108d5ed1677a386ca7f9fc0d 100644 --- a/api/config/settings/common.py +++ b/api/config/settings/common.py @@ -385,3 +385,12 @@ CSRF_USE_SESSIONS = True # Playlist settings PLAYLISTS_MAX_TRACKS = env.int('PLAYLISTS_MAX_TRACKS', default=250) + +ACCOUNT_USERNAME_BLACKLIST = [ + 'funkwhale', + 'root', + 'admin', + 'owner', + 'superuser', + 'staff', +] + env.list('ACCOUNT_USERNAME_BLACKLIST', default=[]) diff --git a/api/tests/users/test_views.py b/api/tests/users/test_views.py index 02b903bf41ea6bb9169987bd5ed1d147aff2122e..4be586965f8d5f02bac7cfc9d3c9b871e2d8fd31 100644 --- a/api/tests/users/test_views.py +++ b/api/tests/users/test_views.py @@ -23,6 +23,23 @@ def test_can_create_user_via_api(preferences, client, db): assert u.username == 'test1' +def test_can_restrict_usernames(settings, preferences, db, client): + url = reverse('rest_register') + preferences['users__registration_enabled'] = True + settings.USERNAME_BLACKLIST = ['funkwhale'] + data = { + 'username': 'funkwhale', + 'email': 'contact@funkwhale.io', + 'password1': 'testtest', + 'password2': 'testtest', + } + + response = client.post(url, data) + + assert response.status_code == 400 + assert 'username' in response.data + + def test_can_disable_registration_view(preferences, client, db): url = reverse('rest_register') data = { diff --git a/changes/changelog.d/139.enhancement b/changes/changelog.d/139.enhancement new file mode 100644 index 0000000000000000000000000000000000000000..c6648d139d9cfac92e9a35557493fcc406ff1d54 --- /dev/null +++ b/changes/changelog.d/139.enhancement @@ -0,0 +1 @@ +We now restrict some usernames from being used during signup (#139)