diff --git a/Sources/Actions/Register2.php b/Sources/Actions/Register2.php index d70f3a486a..a0f27cd102 100644 --- a/Sources/Actions/Register2.php +++ b/Sources/Actions/Register2.php @@ -212,8 +212,13 @@ function (&$value, $key) { Db::$db->free_result($request); } + // What gets stored is the entity encoded form of the name, which is + // wider than what was typed wherever a character needs an entity, + // and real_name holds 255 characters. + $encoded_name = Utils::htmlspecialchars($_POST['real_name'], ENT_QUOTES); + // Only set it if you can and if we are sure it is good - if ($can_edit_display_name && Utils::htmlTrim($_POST['real_name']) != '' && !Security::isReservedName($_POST['real_name']) && Utils::entityStrlen($_POST['real_name']) < 60) { + if ($can_edit_display_name && Utils::htmlTrim($_POST['real_name']) != '' && !Security::isReservedName($_POST['real_name']) && Utils::entityStrlen($_POST['real_name']) < 60 && mb_strlen($encoded_name) <= 255) { $this->possible_strings[] = 'real_name'; } } diff --git a/Sources/Profile.php b/Sources/Profile.php index 0ddd3d12ce..2711ccb38a 100644 --- a/Sources/Profile.php +++ b/Sources/Profile.php @@ -698,7 +698,12 @@ public function loadStandardFields(bool $force_reload = false): void return 'no_name'; } - if (Utils::entityStrlen($value) > 60) { + // The name is stored with entities in place of the characters + // that need them, so it is wider in the column than it was in + // the box: a double quote costs six characters there, an + // ampersand five. real_name holds 255, and a name inside the + // 60 character limit can still be wider than that. + if (Utils::entityStrlen($value) > 60 || mb_strlen($value) > 255) { return 'name_too_long'; }