Bug 357005: 'cf_' should not be allowed as a custom field name

editfields.cgi

@@ -63,8 +63,8 @@ elsif ($action eq 'new') {
     # Validate these fields.
     $name || ThrowUserError('customfield_missing_name');
     # Don't want to allow a name that might mess up SQL.
-    $name =~ /^\w+$/ || ThrowUserError('customfield_invalid_name',
-                                       { name => $name });
+    $name =~ /^\w+$/ && $name ne "cf_"
+      || ThrowUserError('customfield_invalid_name', { name => $name });
     # Prepend cf_ to the custom field name to distinguish it from standard fields.
     if ($name !~ /^cf_/) {
         $name = 'cf_' . $name;

template/en/default/global/user-error.html.tmpl

@@ -319,7 +319,8 @@
   [% ELSIF error == "customfield_invalid_name" %]
     [% title = "Invalid Custom Field Name" %]
     '[% name FILTER html %]' is not a valid name for a custom field.
-    A name may contain only letters, numbers, and the underscore character.
+    A name may contain only letters, numbers, and the underscore character. The
+    name should also be different from 'cf_'.
 
   [% ELSIF error == "customfield_nonexistent" %]
     [% title = "Unknown Custom Field" %]