Do not create a user with the same username than another actor name

diff --git a/server/middlewares/validators/users.ts b/server/middlewares/validators/users.ts
index 4ad0e33da7d203d2d9eedad64d512370b917e81c..8fbab4dd049226217894d3674ce04fd707c8ca7b 100644 (file)
--- a/server/middlewares/validators/users.ts
+++ b/server/middlewares/validators/users.ts
@@ -21,6 +21,7 @@ import { CONFIG, CONSTRAINTS_FIELDS } from '../../initializers'
 import { Redis } from '../../lib/redis'
 import { UserModel } from '../../models/account/user'
 import { areValidationErrors } from './utils'
+import { ActorModel } from '../../models/activitypub/actor'
 
 const usersAddValidator = [
   body('username').custom(isUserUsernameValid).withMessage('Should have a valid username (lowercase alphanumeric characters)'),
@@ -271,6 +272,14 @@ async function checkUserNameOrEmailDoesNotAlreadyExist (username: string, email:
     return false
   }
 
+  const actor = await ActorModel.loadLocalByName(username)
+  if (actor) {
+    res.status(409)
+       .send({ error: 'Another actor (account/channel) with this name already exists.' })
+       .end()
+    return false
+  }
+
   return true
 }
 

diff --git a/server/tests/api/check-params/users.ts b/server/tests/api/check-params/users.ts
index dba57778de4491257a89cf3f837bdf48444f62e9..f36146c538c8bdac0f01cdc42139e958bfa41da5 100644 (file)
--- a/server/tests/api/check-params/users.ts
+++ b/server/tests/api/check-params/users.ts
@@ -179,6 +179,18 @@ describe('Test users API validators', function () {
       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
     })
 
+    it('Should fail with a "peertube" username', async function () {
+      const fields = immutableAssign(baseCorrectParams, { username: 'peertube' })
+
+      await makePostBodyRequest({
+        url: server.url,
+        path,
+        token: server.accessToken,
+        fields,
+        statusCodeExpected: 409
+      })
+    })
+
     it('Should succeed with the correct params', async function () {
       await makePostBodyRequest({
         url: server.url,
@@ -493,6 +505,18 @@ describe('Test users API validators', function () {
       })
     })
 
+    it('Should fail with a "peertube" username', async function () {
+      const fields = immutableAssign(baseCorrectParams, { username: 'peertube' })
+
+      await makePostBodyRequest({
+        url: server.url,
+        path: registrationPath,
+        token: server.accessToken,
+        fields,
+        statusCodeExpected: 409
+      })
+    })
+
     it('Should fail if we register a user with the same email', async function () {
       const fields = immutableAssign(baseCorrectParams, { email: 'admin1@example.com' })