Move to opt-in character replacement

Author: kdumontnu

docs/content/administration/config-cheat-sheet.en-us.md

@@ -598,7 +598,7 @@ And the following unique queues:
   - userid - use the userid / sub attribute
   - nickname - use the nickname attribute
   - email - use the username part of the email attribute
-  - email-normalized - use the username part of the email attribute with diacritics and single-quotes removed, and any other non-supported username characters replaced with a `-` character
+  - email-normalized - use the username part of the email attribute with diacritics and single-quotes removed, and `\s,` replaced with `-`
 - `UPDATE_AVATAR`: **false**: Update avatar if available from oauth2 provider. Update will be performed on each login.
 - `ACCOUNT_LINKING`: **login**: How to handle if an account / email already exists:
   - disabled - show an error

models/user/user.go

@@ -520,12 +520,12 @@ func GetUserSalt() (string, error) {
 	return hex.EncodeToString(rBytes), nil
 }
 
-// Developer warning: The set of characters here can safely expand without a breaking change,
+// Note: The set of characters here can safely expand without a breaking change,
 // but characters removed from this set can cause user account linking to break
 var (
-	invalidUsernameCharsRE    = regexp.MustCompile(`[^\w-.]`)
+	removeCharsRE             = regexp.MustCompile(`['\x60]`)
 	removeDiacriticsTransform = transform.Chain(norm.NFD, runes.Remove(runes.In(unicode.Mn)), norm.NFC)
-	removeChars               = strings.NewReplacer("'", "", "`", "")
+	replaceCharsRE            = regexp.MustCompile(`[\s,]`)
 )
 
 // normalizeUserName returns a string with single-quotes and diacritics
@@ -536,7 +536,7 @@ func NormalizeUserName(s string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("Failed to normalize character `%v` in provided username `%v`", s[n], s)
 	}
-	return invalidUsernameCharsRE.ReplaceAllString(removeChars.Replace(strDiacriticsRemoved), "-"), nil
+	return replaceCharsRE.ReplaceAllLiteralString(removeCharsRE.ReplaceAllLiteralString(strDiacriticsRemoved, ""), "-"), nil
 }
 
 var (