reject usernames made only of dots

A username of "." or ".." passed validation, but browsers resolve those as path segments, so requests to /users/{username} never reached the API and the user could not be deleted or edited from the UI. User creation now rejects dot-only names in both the API and the create user dialog.

frigate/api/auth.py

@@ -912,7 +912,7 @@ def create_user(
     HASH_ITERATIONS = request.app.frigate_config.auth.hash_iterations
     config_roles = list(request.app.frigate_config.auth.roles.keys())
 
-    if not re.match("^[A-Za-z0-9._]+$", body.username):
+    if not re.match(r"^(?!\.+$)[A-Za-z0-9._]+$", body.username):
         return JSONResponse(content={"message": "Invalid username"}, status_code=400)
 
     if body.role not in config_roles:

frigate/test/http_api/test_http_users.py

@@ -0,0 +1,33 @@
+"""Tests for user creation."""
+
+from unittest.mock import MagicMock
+
+from frigate.models import User
+from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
+
+PASSWORD = "a-valid-password-123"
+
+
+class TestCreateUser(BaseTestHttp):
+    def setUp(self):
+        super().setUp([User])
+        self.app = super().create_app()
+        self.app.config_publisher = MagicMock()
+
+    def _create(self, username: str):
+        with AuthTestClient(self.app) as client:
+            return client.post(
+                "/users",
+                json={"username": username, "password": PASSWORD, "role": "viewer"},
+            )
+
+    def test_rejects_dot_only_usernames(self):
+        # browsers resolve these as URL path segments, so the per-user
+        # endpoints can never be reached for them
+        for username in (".", "..", "..."):
+            assert self._create(username).status_code == 400
+            assert User.get_or_none(User.username == username) is None
+
+    def test_accepts_username_containing_dots(self):
+        assert self._create("john.doe_1").status_code == 200
+        assert User.get_or_none(User.username == "john.doe_1") is not None

web/src/components/overlay/CreateUserDialog.tsx

@@ -80,7 +80,7 @@ export default function CreateUserDialog({
       user: z
         .string()
         .min(1, t("users.dialog.form.usernameIsRequired"))
-        .regex(/^[A-Za-z0-9._]+$/, {
+        .regex(/^(?!\.+$)[A-Za-z0-9._]+$/, {
           message: t("users.dialog.createUser.usernameOnlyInclude"),
         }),
       password: z