This is sort of a dump of what I've done so far. I realized I need to divert myself to the access_api briefly because the access control checks are getting really confusing. I'm going to go look at renaming some of those functions.

• config_defaults_inc.php
  (g_manage_user_threshold): new config option to control access to user
  management functions (create/delete/modify)

• constant_inc.php
  (ERROR_USER_NAME_INVALID): new error

• manage_user_create.php

• manage_user_create_page.php

• manage_user_delete.php

• manage_user_edit_page.php

• manage_user_page.php

• manage_user_proj_add.php

• manage_user_proj_delete.php
  cleanup this files

• core/user_api.php
  (user_is_name_valid):
  new function that checks a username for validity. We
  may need to expand this definition to include other character sets? (though
  the PCRE regexes say they take localization into account). We might also
  need to add a config option to make the checking less strict for systems
  that already have users with names that contain weird characters.

  (user_ensure_name_valid):
  error-triggering version of above

  (user_create):
  call user_ensure_name_valid() before creating the user

  (user_set_name):
  new function that checks the username for validity before setting it. If
  you subvert this function and use user_set_field() directly, you should
  check the username yourself.

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@1823 <a class="text" href="/?p=mantisbt.git;a=object;h=f5dc347c">f5dc347c</a>-c33d-0410-90a0-b07cc1902cb9