HELP! Need help blocking invisible unicode chars in usernames.
 

Hello,

I am running vB 3.8.6 (it's outdated, I know, but the people who host/own our forums refuse to respond to my pleas to update).

There are users who are joining with invisible space Unicode characters and naming themselves after moderators. The vB treats them as 2 users, but I noticed that when I banned "_Moderator" (Where "_" is the invisible space), it not only banned the fake account but the REAL moderator account as well. To combat this I had to rename the account to Moderator2 so that I could ban (and rename) the fake account. I am worried that this exploit may possibly grant these dupe accounts access to the staff forums. I do not know which Unicode symbols they are using, because when they register as a string of them we cannot click their usernames, and we do not know what to search.

If there's a list of blank space unicode characters that I can add to the block list I'd REALLY appreciate some direction on where to go.

Thanks a lot in advance. :)

edit: Managed to use some trickery to pull up one of their usernames. Here is a copy/paste job of it:
" " <--- It is copy/pasted between these quotation marks.
" " <--- Another
" " <-- A third one.-

3.8.6 is the pinnacle of vB achievement, it is NOT outdated. Your forum overlords are wise for not upgrading, I don't see anything in vb4 that would solve this problem.

if your running 3.8.6 & not 3.8.6 pl1, you better upgrade before your hacked.

admincp --> vbulletin options --> user registrations --> username regular expression

^[A-Za-z0-9 ]+$

limit usernames to alpha char's, numbers & spaces only.

Would that screw up people who registered before with apostrophes? Or is there a way to add apostrophes to the allowed list?

No, it will not interfere with users who are already registered.

Thanks, I actually found this regular expression:
Which allows for more characters but still prevents the 'hidden' ones.

Should work fine.

You can also strip char's out with this, when they try to register.

^((?!&#\d+;)[\x20-\x7E])+$