relax regexp for input validation on userids

OpenConext · Oct 2, 2015 · 6514a71 · 6514a71
1 parent 4f6757a
commit 6514a71
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/www/tiqr/tiqr.php b/www/tiqr/tiqr.php
@@ -118,7 +118,7 @@ function register( $enrollmentSecret, $secret, $notificationType, $notificationA
                 break;
             case "login":
                 $sessionKey = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['sessionKey']);
-                $userId = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['userId']);
+                $userId = preg_replace("/[^a-zA-Z0-9_-]+/", "", $_POST['userId']);
                 $response = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['response']);
                 logger()->addInfo(sprintf("received authentication response (%s) from user '%s' for session '%s'", $response, $userId, $sessionKey));
                 $result = login( $sessionKey, $userId, $response );