pfSense

/*

 * Function to remove problematic characters from a username before using it in

 * logs or other sensitive contexts.

 *

 * These usernames are not valid, so there is little use in printing them as-is.

 */

function cleanup_invalid_username($username) {

	$clean_username = "";

	/* Trim to 32 chars, add string indicate text was removed */

	if (strlen($username) > 32) {

		$username = substr($username, 0, 32);

		$username .= "__truncated__";

	}

	/* Replace any non-word characters */

	for ($i=0; $i < strlen($username); $i++) {

		if (preg_match('/\w/', $username[$i])) {

			$clean_username .= $username[$i];

		} else {

			$clean_username .= "_";

		}

	}

	return $clean_username;

}

			log_auth(sprintf("webConfigurator authentication error for user '%1\$s' from: %2\$s",

				cleanup_invalid_username($_POST['usernamefld']),

				get_user_remote_address(false)));

			log_auth(sprintf("webConfigurator authentication error for user '%1\$s' from: %2\$s",

			    cleanup_invalid_username($username),