Refs #21379 -- Normalized unicode username inputs

2 files changed, 30 insertions, 0 deletions

diff --git a/tests/auth_tests/test_basic.py b/tests/auth_tests/test_basic.py
index da42f4055f..87122d9229 100644
--- a/tests/auth_tests/test_basic.py
+++ b/tests/auth_tests/test_basic.py
@@ -7,6 +7,7 @@ from django.apps import apps
 from django.contrib.auth import get_user_model
 from django.contrib.auth.models import AnonymousUser, User
 from django.core.exceptions import ImproperlyConfigured
+from django.db import IntegrityError
 from django.dispatch import receiver
 from django.test import TestCase, override_settings
 from django.test.signals import setting_changed
@@ -60,6 +61,12 @@ class BasicTestCase(TestCase):
     def test_unicode_username(self):
         User.objects.create_user('jörg')
         User.objects.create_user('Григорий')
+        # Two equivalent unicode normalized usernames should be duplicates
+        omega_username = 'iamtheΩ'  # U+03A9 GREEK CAPITAL LETTER OMEGA
+        ohm_username = 'iamtheΩ'  # U+2126 OHM SIGN
+        User.objects.create_user(ohm_username)
+        with self.assertRaises(IntegrityError):
+            User.objects.create_user(omega_username)
 
     def test_is_anonymous_authenticated_method_deprecation(self):
         deprecation_message = (
diff --git a/tests/auth_tests/test_forms.py b/tests/auth_tests/test_forms.py
index 212dff1ab0..d2ce828eb8 100644
--- a/tests/auth_tests/test_forms.py
+++ b/tests/auth_tests/test_forms.py
@@ -3,6 +3,7 @@ from __future__ import unicode_literals
 
 import datetime
 import re
+from unittest import skipIf
 
 from django import forms
 from django.contrib.auth.forms import (
@@ -118,6 +119,28 @@ class UserCreationFormTest(TestDataMixin, TestCase):
         else:
             self.assertFalse(form.is_valid())
 
+    @skipIf(six.PY2, "Python 2 doesn't support unicode usernames by default.")
+    def test_duplicate_normalized_unicode(self):
+        """
+        To prevent almost identical usernames, visually identical but differing
+        by their unicode code points only, Unicode NFKC normalization should
+        make appear them equal to Django.
+        """
+        omega_username = 'iamtheΩ'  # U+03A9 GREEK CAPITAL LETTER OMEGA
+        ohm_username = 'iamtheΩ'  # U+2126 OHM SIGN
+        self.assertNotEqual(omega_username, ohm_username)
+        User.objects.create_user(username=omega_username, password='pwd')
+        data = {
+            'username': ohm_username,
+            'password1': 'pwd2',
+            'password2': 'pwd2',
+        }
+        form = UserCreationForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(
+            form.errors['username'], ["A user with that username already exists."]
+        )
+
     @override_settings(AUTH_PASSWORD_VALIDATORS=[
         {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
         {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': {