check email/username syntax before sending it to db

src/Controller/LoginController.php

@@ -81,13 +81,11 @@ class LoginController
 
         if (\Container::$request->session()->has('tmp_user_data')) {
             $tmpUserData = \Container::$request->session()->get('tmp_user_data');
-
-            $data = ['email' => $tmpUserData['email']];
         } else {
-            $data = [];
+            $tmpUserData = [];
         }
 
-        return new HtmlContent('login/signup', $data);
+        return new HtmlContent('login/signup', $tmpUserData);
     }
 
     public function getSignupSuccess()
@@ -159,6 +157,13 @@ class LoginController
             return new JsonContent(['success' => true]);
         }
 
+        if (
+            filter_var(\Container::$request->post('email'), FILTER_VALIDATE_EMAIL) === false &&
+            preg_match('/^[a-zA-Z0-9_\-\.]+$/', \Container::$request->post('email')) !== 1
+        ) {
+            return new JsonContent(['error' => ['errorText' => 'This is not a valid email address or username.']]);
+        }
+
         $user = $this->userRepository->getByEmailOrUsername(\Container::$request->post('email'));
 
         if ($user === null) {
@@ -173,10 +178,14 @@ class LoginController
             $tmpUser = new User();
             $tmpUser->setPlainPassword(\Container::$request->post('password'));
 
-            \Container::$request->session()->set('tmp_user_data', [
-                'email' => \Container::$request->post('email'),
-                'password_hashed' => $tmpUser->getPassword()
-            ]);
+            $tmpUserData = ['password_hashed' => $tmpUser->getPassword()];
+            if (filter_var(\Container::$request->post('email'), FILTER_VALIDATE_EMAIL) === false) {
+                $tmpUserData['username'] = \Container::$request->post('email');
+            } else {
+                $tmpUserData['email'] = \Container::$request->post('email');
+            }
+
+            \Container::$request->session()->set('tmp_user_data', $tmpUserData);
 
             return new JsonContent([
                 'redirect' => [
@@ -498,6 +507,13 @@ class LoginController
             }
         }
 
+        if (
+            filter_var(\Container::$request->post('email'), FILTER_VALIDATE_EMAIL) === false &&
+            preg_match('/^[a-zA-Z0-9_\-\.]+$/', \Container::$request->post('email')) !== 1
+        ) {
+            return new JsonContent(['error' => ['errorText' => 'This is not a valid email address or username.']]);
+        }
+
         $user = $this->userRepository->getByEmailOrUsername(\Container::$request->post('email'));
 
         if ($user === null) {

views/login/login.php

@@ -4,7 +4,7 @@
     <h2>Login</h2>
     <div class="box">
         <form id="loginForm" action="/login" method="post" data-redirect-on-success="<?= $redirectUrl ?>">
-            <input type="email" class="text big fullWidth" name="email" placeholder="Email address / username" autocomplete="username" required autofocus>
+            <input type="text" class="text big fullWidth" name="email" placeholder="Email address / username" autocomplete="username" required autofocus>
             <input type="password" class="text big fullWidth marginTop" name="password" placeholder="Password" autocomplete="current-password" required minlength="6">
             <p id="loginFormError" class="formError justify marginTop"></p>
             <div class="right marginTop">

views/login/password_reset_request.php

@@ -6,7 +6,7 @@
     <h2>Request password reset</h2>
     <div class="box">
         <form id="passwordResetForm" action="/password/requestReset" method="post" data-redirect-on-success="/password/requestReset/success">
-            <input type="email" class="text big fullWidth" name="email" placeholder="Email address / username" autocomplete="username" value="<?= isset($email) ? $email : '' ?>" required autofocus>
+            <input type="text" class="text big fullWidth" name="email" placeholder="Email address / username" autocomplete="username" value="<?= isset($email) ? $email : '' ?>" required autofocus>
             <?php if (!empty($_ENV['RECAPTCHA_SITEKEY'])): ?>
                 <div class="marginTop">
                     <div class="g-recaptcha" data-sitekey="<?= $_ENV['RECAPTCHA_SITEKEY'] ?>"></div>

views/login/signup.php

@@ -7,16 +7,25 @@
     <h2>Sign up</h2>
     <div class="box">
         <form id="signupForm" action="/signup" method="post" data-redirect-on-success="/signup/success">
-            <?php if (isset($email)): ?>
+            <?php if (isset($email) || isset($username)): ?>
                 <p class="justify">No user found with the given email address / username. Sign up with one click!</p>
-                <input type="email" class="text big fullWidth marginTop" name="email" placeholder="Email address" autocomplete="username" value="<?= $email ?>" required>
-                <input type="password" class="text big fullWidth marginTop" name="password" placeholder="Password confirmation" autocomplete="new-password" required minlength="6" autofocus>
+                <?php if (isset($email)): ?>
+                    <input type="email" class="text big fullWidth marginTop" name="email" placeholder="Email address" autocomplete="username" value="<?= $email ?>" required>
+                <?php else: ?>
+                    <input type="email" class="text big fullWidth marginTop" name="email" placeholder="Email address" autocomplete="username" required autofocus>
+                <?php endif; ?>
+                <?php if (isset($username)): ?>
+                    <input type="username" class="text big fullWidth marginTop" name="username" placeholder="Username" value="<?= $username ?>">
+                <?php else: ?>
+                    <input type="username" class="text big fullWidth marginTop" name="username" placeholder="Username" autofocus>
+                <?php endif; ?>
+                <input type="password" class="text big fullWidth marginTop" name="password" placeholder="Password confirmation" autocomplete="new-password" required minlength="6">
             <?php else: ?>
                 <input type="email" class="text big fullWidth" name="email" placeholder="Email address" autocomplete="username" required autofocus>
+                <input type="username" class="text big fullWidth marginTop" name="username" placeholder="Username">
                 <input type="password" class="text big fullWidth marginTop" name="password" placeholder="Password" autocomplete="new-password" required minlength="6">
                 <input type="password" class="text big fullWidth marginTop" name="password_confirm" placeholder="Password confirmation" autocomplete="new-password" minlength="6">
             <?php endif; ?>
-            <input type="username" class="text big fullWidth marginTop" name="username" placeholder="Username">
             <?php if (!empty($_ENV['RECAPTCHA_SITEKEY'])): ?>
                 <div class="marginTop">
                     <div class="g-recaptcha" data-sitekey="<?= $_ENV['RECAPTCHA_SITEKEY'] ?>"></div>