--- a/mercurial/changelog.py	Wed Sep 10 22:37:07 2008 +0200
+++ b/mercurial/changelog.py	Sat Sep 13 17:46:09 2008 +0200
@@ -6,7 +6,8 @@
 # of the GNU General Public License, incorporated herein by reference.
 
 from node import bin, hex, nullid
-from revlog import revlog
+from revlog import revlog, RevlogError
+from i18n import _
 import util
 
 def _string_escape(text):
@@ -178,6 +179,9 @@
     def add(self, manifest, list, desc, transaction, p1=None, p2=None,
                   user=None, date=None, extra={}):
 
+        user = user.strip()
+        if "\n" in user:
+            raise RevlogError(_("username %s contains a newline") % `user`)
         user, desc = util.fromlocal(user), util.fromlocal(desc)
 
         if date:

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/test-username-newline	Sat Sep 13 17:46:09 2008 +0200
@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+
+hg init foo
+cd foo
+touch a
+
+
+unset HGUSER
+echo "[ui]" >> .hg/hgrc
+echo "username= foo" >> .hg/hgrc
+echo "          bar1" >> .hg/hgrc
+
+hg ci -Am m
+
+rm .hg/hgrc
+
+HGUSER=`(echo foo; echo bar2)` hg ci -Am m
+
+hg ci -Am m -u "`(echo foo; echo bar3)`"
+
+true

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/test-username-newline.out	Sat Sep 13 17:46:09 2008 +0200
@@ -0,0 +1,12 @@
+adding a
+transaction abort!
+rollback completed
+abort: username 'foo\nbar1' contains a newline
+
+transaction abort!
+rollback completed
+abort: username 'foo\nbar2' contains a newline
+
+transaction abort!
+rollback completed
+abort: username 'foo\nbar3' contains a newline!