At sign/arroba in WP.org Username causes Trac Profile link to fail

[chriscct7]

If a username contains an ampersand, on Trac, the link to the user doesn't work on tickets. Example: the guy who wrote the patch on ​https://core.trac.wordpress.org/ticket/12684#comment:12. While usernames can have ampersands in WordPress and that's fine, based on that bug, maybe Trac needs to be audited to make sure that can't cause anything unintended security wise over there?

[samuelsidler]

We should just stop allowing weird characters in usernames. Didn't we do that already at some point? @Otto42?

But the link you gave was to a username that has an at symbol, not an ampersand. :)

[chriscct7]

Heh, indeed, at sign/arroba not ampersand. Will correct.

[netweb]

[[Image(Replying to samuelsidler:

Didn't we do that already at some point? @Otto42?

Not @ for Trac as far as I can tell (or remember)

We've done these @ things though ;)

#80 Link @usernames across network
#82 @username links should go to profile, not mentions
#216 Block @ in WPORG usernames

[Otto42]

We stopped allowing at symbols in usernames a while back. However, people who had made usernames prior to that point probably still have them.

However, dipali.dhole27's profile link works fine.

[chriscct7]

Replying to Otto42:

We stopped allowing at symbols in usernames a while back. However, people who had made usernames prior to that point probably still have them.

However, dipali.dhole27's profile link works fine.

The link I get when logged in is "​https://profiles.wordpress.org/dipali.dhole27@%E2%80%A6". This when clicked redirects to the WordPress.org homepage

[SergeyBiryukov]

Replying to chriscct7:

The link I get when logged in is "​https://profiles.wordpress.org/dipali.dhole27@%E2%80%A6". This when clicked redirects to the WordPress.org homepage

Confirmed (when logged out though, not when logged in).

[Otto42]

When logged out, it does show a difference there. However, I think the issue may be the length of the username? Trac seems to be shortening it, or truncating it because it recognizes it as an email? Not sure. Works fine when logged in, for me.

I think the bottom line is that usernames should not be email addresses. We don't allow them anymore. Probably no way to fix this without that person creating a new account, and not using the email for the username.