+++ This bug was initially created as a clone of Bug #54589 +++ The regular expression für the UDM syntax gid does not represent what is really meant by the author and what is useful. " -." does not only allow the characters space, dash and dot but all characters in the ASCII range " " (32) up to "." (46) → see list of wrongly allowed characters below. IIRC the correct regex would be: u"(?u)^\\w([\\w .-]*\\w)?$" ALSO: Please check, why single ticks are currently allowed in group names! Also note: this is a breaking change. We have to find an appropriate release for this change and have to announce this change before! (in case a customer used a lot of e.g. plus signs in group names) class gid(simple): min_length = 1 # TODO: not enforced here max_length = 32 # TODO: not enforced here regex = re.compile(u"(?u)^\\w([\\w -.’]*\\w)?$") # FIXME: The " -." in "[\w -.]" matches the ASCII character range(ord(' '), ord('.')+1) == range(32, 47) error_message = _( "A group name must start and end with a letter, number or underscore. In between additionally spaces, dashes " "and dots are allowed." ) $ python3 >>> for i in range(ord(' '), ord('.')+1): print(i, repr(chr(i))) ... 32 ' ' 33 '!' 34 '"' 35 '#' 36 '$' 37 '%' 38 '&' 39 "'" 40 '(' 41 ')' 42 '*' 43 '+' 44 ',' 45 '-' 46 '.' >>> root@master:~# udm groups/group create --position cn=groups,$(ucr get ldap/base) --set name="Group (name) + cool2" Object created: cn=Group (name) \+ cool,cn=groups,dc=dev,dc=nstx,dc=de
cherry-picked e84befeb173 chore(udm): update advisory 4fb2ae6de19 feat(udm): Allow trailing dash in uid and gid syntaxes Successful build Package: univention-directory-manager-modules Version: 17.4.4 Release: 5.2-0 Scope: errata5.2-4
OK: changes to the syntax classes are backwards compatible OK: syntax allow trailing dash OK: advisory FYI: git:51977581d41ebc97361c4708839c980441018d6c adds a univention.testing.strings.random_username_special_characters() The following chars cannot be used currently: '@', # heimdal kerberos principal name breaks due to duplicated @ '$', # not identifyable as users/user r'"/\[]:;|=,+*?<>', # ldap.CONSTRAINT_VIOLATION: "0000202F: samldb: sAMAccountName contains invalid '+' character\n", see https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccountname Special chars which can be used: "!#%&'()-.^_`{}~ ´€Ω®½"
<https://errata.software-univention.de/#/?erratum=5.2x307>