User names are checked in a case-sensitive manner, which is a problem on PostgreSQL. (forum topic)

Patch below. Please note I commented out some other code which has a 'mySQL specific' comment attached... I don't know what should be done with that (and if it works on PostgreSQL anyway; I didn't try).

--- /usr/local/pkg/drupal/drupal-4.4.1/modules/user.module      2004-05-02 17:45:30.000000000 +0200
+++ modules/user.module 2004-05-11 21:30:10.000000000 +0200
@@ -34,7 +34,7 @@
       $query .= "u.$key = '". md5($value) ."' AND ";
     }
     else {
-      $query .= "u.$key = '". check_query($value) ."' AND ";
+      $query .= "LOWER(u.$key) = '". strtoLower(check_query($value)) ."' AND ";
     }
   }
   $result = db_query_range("SELECT u.*, r.name AS role FROM {role} r INNER JOIN {users} u ON r.rid = u.rid WHERE $query u.
status < 3", 0, 1);
@@ -296,11 +296,7 @@
 
 function user_search($keys) {
   $find = array();
-
-  // Replace wildcards with mysql wildcards
-  $keys = str_replace("*", "%", $keys);
-
-  $result = db_query_range("SELECT * FROM {users} WHERE name LIKE '%%%s%%'", $keys, 0, 20);
+  $result = db_query_range("SELECT * FROM {users} WHERE LOWER(name) LIKE '%%%s%%'", strtoLower($keys), 0, 20);
   while ($account = db_fetch_object($result)) {
     $find[] = array("title" => $account->name, "link" => (strstr(request_uri(), "admin") ? url("admin/user/edit/$account->
uid") : url("user/view/$account->uid")), 'user' => $account->name);
   }
@@ -700,11 +696,11 @@
   global $base_url;
 
   if ($edit['name']) {
-    $account = db_fetch_object(db_query("SELECT uid, name, mail FROM {users} WHERE status = 1 AND name = '%s'", $edit['nam
e']));
+    $account = db_fetch_object(db_query("SELECT uid, name, mail FROM {users} WHERE status = 1 AND LOWER(name) = '%s'", str
toLower($edit['name'])));
     if (!$account) $error = t("Sorry. The username <i>%s</i> is not recognized.", array("%s" => $edit['name']));
   }
   else if ($edit['mail']) {
-    $account = db_fetch_object(db_query("SELECT uid, name, mail FROM {users} WHERE status = 1 AND mail = '%s'", $edit['mai
l']));
+    $account = db_fetch_object(db_query("SELECT uid, name, mail FROM {users} WHERE status = 1 AND LOWER(mail) = '%s'", str
toLower($edit['mail'])));
     if (!$account) $error = t("Sorry. The e-mail address <i>%s</i> is not recognized.", array("%s" => $edit['mail']));
   }
   if ($account) {
CommentFileSizeAuthor
#3 casesensitiveusers.patch2.08 KBroderik

Comments

gábor hojtsy’s picture

Why is it a problem, that user names are case sensitive?

dries’s picture

Goba: we tend to use LOWER() elsewhere in the user module queries.

Could you please upload a patch instead of copy-pasting it?

roderik’s picture

StatusFileSize
new2.08 KB

Goba: Maybe I'd have reacted the same if I hadn't seen a hint of the effects.
Trust me, you will get some user complaining to you because he can't login... because he's logging in with name 'roderik', forgetting that he registered with name 'Roderik'.
It has happened to me, and I don't consider myself stupid :)

(And with all community/board sites _except_ Drupal, it is no problem. They also tend to check case-insensitively.)

Dries: OK, I'm learning... :)
Here's the patch, with the addition that I UNcommented the 'mysql wildcard' line again. (I just changed the comment there; it is the same on PostgreSQL so needs no change in the code.)

gábor hojtsy’s picture

I understood what Dries pointed out, but not faced this problem, since we are using MySQL.

dries’s picture

Committed to HEAD and to DRUPAL-4-4. Thanks.

Anonymous’s picture