Repository: weni-ai/bothub-engine

Issue:
User can set "api", "docs" or "admin" as nickname
In production this generate url conflict


Discussion:
Reported in https://github.com/push-flow/bothub-issues/issues/8

Resolving patch:
diff --git a/bothub/authentication/migrations/0005_auto_20180620_2059.py b/bothub/authentication/migrations/0005_auto_20180620_2059.py
new file mode 100644
--- /dev/null
+++ b/bothub/authentication/migrations/0005_auto_20180620_2059.py
@@ -0,0 +1,21 @@
+# Generated by Django 2.0.6 on 2018-06-20 20:59
+
+import bothub.authentication.models
+import django.core.validators
+from django.db import migrations, models
+import re
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authentication', '0004_auto_20180605_1357'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='user',
+            name='nickname',
+            field=models.CharField(help_text="User's nickname, using letters, numbers, underscores and hyphens without spaces.", max_length=16, unique=True, validators=[django.core.validators.RegexValidator(re.compile('^[-a-zA-Z0-9_]+\\Z'), "Enter a valid 'nickname' consisting of letters, numbers, underscores or hyphens.", 'invalid'), bothub.authentication.models.validate_user_nickname_value], verbose_name='nickname'),
+        ),
+    ]
diff --git a/bothub/authentication/models.py b/bothub/authentication/models.py
--- a/bothub/authentication/models.py
+++ b/bothub/authentication/models.py
@@ -8,10 +8,11 @@
 from django.core.mail import send_mail
 from django.template.loader import render_to_string
 from django.conf import settings
+from django.core.exceptions import ValidationError
 
 
 user_nickname_re = _lazy_re_compile(r'^[-a-zA-Z0-9_]+\Z')
-validate_user_nickname = RegexValidator(
+validate_user_nickname_format = RegexValidator(
     user_nickname_re,
     _('Enter a valid \'nickname\' consisting of letters, numbers, ' +
         'underscores or hyphens.'),
@@ -19,6 +20,12 @@
 )
 
 
+def validate_user_nickname_value(value):
+    if value in ['api', 'docs', 'admin']:
+        raise ValidationError(
+            _('The user nickname can\'t be \'{}\'').format(value))
+
+
 class UserManager(BaseUserManager):
     def _create_user(self, email, nickname, password=None, **extra_fields):
         if not email:
@@ -66,7 +73,10 @@ class Meta:
     nickname = models.CharField(
         _('nickname'),
         max_length=16,
-        validators=[validate_user_nickname],
+        validators=[
+            validate_user_nickname_format,
+            validate_user_nickname_value,
+        ],
         help_text=_('User\'s nickname, using letters, numbers, underscores ' +
                     'and hyphens without spaces.'),
         unique=True)


Test patch:
diff --git a/bothub/api/tests/test_user.py b/bothub/api/tests/test_user.py
--- a/bothub/api/tests/test_user.py
+++ b/bothub/api/tests/test_user.py
@@ -76,6 +76,28 @@ def test_unique_nickname(self):
             'nickname',
             content_data.keys())
 
+    def test_invalid_nickname_url_conflict(self):
+        URL_PATHS = [
+            'api',
+            'docs',
+            'admin',
+        ]
+
+        for url_path in URL_PATHS:
+            response, content_data = self.request({
+                'email': '{}@fake.com'.format(url_path),
+                'name': 'Fake',
+                'nickname': url_path,
+                'password': 'abc!1234',
+            })
+
+            self.assertEqual(
+                response.status_code,
+                status.HTTP_400_BAD_REQUEST)
+            self.assertIn(
+                'nickname',
+                content_data.keys())
+
 
 class UserUpdateTestCase(TestCase):
     def setUp(self):