Usernames must start with a letter (#5581)

model/user.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"regexp"
 	"strings"
+	"unicode"
 	"unicode/utf8"
 
 	"golang.org/x/crypto/bcrypt"
@@ -142,7 +143,7 @@ func (u *User) PreSave() {
 	}
 
 	if u.Username == "" {
-		u.Username = NewId()
+		u.Username = "n" + NewId()
 	}
 
 	if u.AuthData != nil && *u.AuthData == "" {
@@ -572,6 +573,10 @@ func IsValidUsername(s string) bool {
 		return false
 	}
 
+	if !unicode.IsLetter(rune(s[0])) {
+		return false
+	}
+
 	for _, restrictedUsername := range restrictedUsernames {
 		if s == restrictedUsername {
 			return false

model/user_test.go

@@ -95,7 +95,7 @@ func TestUserIsValid(t *testing.T) {
 		t.Fatal()
 	}
 
-	user.Username = NewId()
+	user.Username = "n" + NewId()
 	user.Email = strings.Repeat("01234567890", 20)
 	if err := user.IsValid(); err == nil {
 		t.Fatal()
@@ -189,6 +189,10 @@ var usernames = []struct {
 	expected bool
 }{
 	{"spin-punch", true},
+	{"sp", false},
+	{"1spin-punch", false},
+	{"-spin-punch", false},
+	{".spin-punch", false},
 	{"Spin-punch", false},
 	{"spin punch-", false},
 	{"spin_punch", true},