Question on Allowed Username Characters CL_username_chars

[eluser]Unknown[/eluser]
Dear all,

I can't seem to locate the problem here.

I want to only allow a-Z, 0-9 and unserscore (_) in the username. As such I only define
$config['CL_username_chars'] = '_';

However, the callback function username_format() in CL_Auth.php doesn't seem to check the username format correctly. It disallow non-alphanumeric character in the beginning and ending of username, but it allows any character in between. E.g.:
"_user" and "user_" are illegal, but
"user name,1" is legal.

This seem to contradict the purpose of the function.

What is wrong with this statement in username_format() function? Or my understanding is incorrect?

if ( !preg_match('/^[-a-z0-9$chars]/i', $username) )
{
return true;
}

Thanks in advance.

[eluser]abmcr[/eluser]
You have also posted....
http://ellislab.com/forums/viewthread/78...20/#580789