plugwash wrote:

imho the allowed stuff in usernames should be based on a whitelist. Using a
blacklist means that you will always risk missing stuff that vandals would find
usefull.

usenet wrote:

See also Bug 2290: user impersonation using homographs for a wider perspective...

gangleri wrote:

see also

bug 1524: usernames should use unicode whitelist

a.koppad wrote:

I tried to login within a "#$$%%%%" which throws the login error, "You have not specified a valid user name.". I also tried to do Ctrl^C, Ctrl^V, and other fields that I could think of. The form does allow you to enter illegal characters. So this issue is resolved for now.

a.koppad wrote:

Hi,

I am sorry about the last sentence in the last post. I meant to say I tested and tried to reproduce the error but with no success.

(In reply to comment #4)

I tried to login within a "#$$%%%%"

These are visible, printable characters. Comment 0 mentions "non-printing characters". See http://en.wikipedia.org/wiki/Non-printing_character

I tried on test2.wikipedia.org (version 1.21wmf5) to create an account as Maly­acko (save as HTML file, open it in browser, copy from the browser display, as described in comment 0).

RESULT:

Login error
The name "Maly­acko" is not allowed to prevent confusing or spoofed usernames: Contains unassigned character U+00AD. Please choose another name.

So I consider this FIXED as there is a check in place (though I don't know where a blacklist or whitelist is located though, and which exact characters are covered by it).