From e6dbfd918c8d68c29c01bf2617321b037393ada1 Mon Sep 17 00:00:00 2001
From: Unknwon <u@gogs.io>
Date: Tue, 7 Mar 2017 14:07:20 -0500
Subject: [PATCH] security: fix vulnerability in changing username
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported by João Arnaut.
---
 gogs.go                              | 2 +-
 modules/form/user.go                 | 2 +-
 templates/.VERSION                   | 2 +-
 templates/user/settings/profile.tmpl | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gogs.go b/gogs.go
index de878e506..bdf8c1635 100644
--- a/gogs.go
+++ b/gogs.go
@@ -16,7 +16,7 @@ import (
 	"github.com/gogits/gogs/modules/setting"
 )
 
-const APP_VER = "0.10.7.0306"
+const APP_VER = "0.10.8.0307"
 
 func init() {
 	setting.AppVer = APP_VER
diff --git a/modules/form/user.go b/modules/form/user.go
index c7d7a3d6b..a7a34925d 100644
--- a/modules/form/user.go
+++ b/modules/form/user.go
@@ -90,7 +90,7 @@ func (f *SignIn) Validate(ctx *macaron.Context, errs binding.Errors) binding.Err
 //         \/         \/                                   \/        \/        \/
 
 type UpdateProfile struct {
-	Name     string `binding:"OmitEmpty;MaxSize(35)"`
+	Name     string `binding:"Required;AlphaDashDot;MaxSize(35)"`
 	FullName string `binding:"MaxSize(100)"`
 	Email    string `binding:"Required;Email;MaxSize(254)"`
 	Website  string `binding:"Url;MaxSize(100)"`
diff --git a/templates/.VERSION b/templates/.VERSION
index b4e314628..45f831e3e 100644
--- a/templates/.VERSION
+++ b/templates/.VERSION
@@ -1 +1 @@
-0.10.7.0306
\ No newline at end of file
+0.10.8.0307
\ No newline at end of file
diff --git a/templates/user/settings/profile.tmpl b/templates/user/settings/profile.tmpl
index a42d9c49c..a41811be1 100644
--- a/templates/user/settings/profile.tmpl
+++ b/templates/user/settings/profile.tmpl
@@ -25,7 +25,7 @@
 						</div>
 						<div class="required field {{if .Err_Email}}error{{end}}">
 							<label for="email">{{.i18n.Tr "email"}}</label>
-							<input id="email" name="email" value="{{.SignedUser.Email}}">
+							<input id="email" name="email" value="{{.SignedUser.Email}}" required>
 						</div>
 						<div class="field {{if .Err_Website}}error{{end}}">
 							<label for="website">{{.i18n.Tr "settings.website"}}</label>