When a new user is created in drupal and synched to phpBB, the username automatically becomes lower case.
In the database there is a post (username_clean) that has the lower case name and another post (username) that has upper and lower case letters. Im having troubble logging in with the "username", but it is possible to log in with the "username_clean".
I would like to able to log in with a username with uppercase letters in phpBB

Comments

ywarnier’s picture

I have the same problem following an installation of the phpBB module on a Drupal with already 5000 members. The members who got uppercase letters in their Drupal username cannot login to their account at all. Drupal returns a message saying:

"The phpBB username guillaume is not found in phpBB." (notice)
and then
"Sorry, unrecognized username or password. Have you forgotten your password?" (error)

I tried updating the account credentials (username and username clean) inside the phpbb_users table, but apparently that doesn't work.

ywarnier’s picture

A few additional notes: changing the username and username_clean to lowercase in the phpbb_users table apparently doesn't solve the problem, so I'm trying to get further down.

I traced down the phpbb user authentication mechanism to phpbbforum/phpbbforum.module int the function _phpbbforum_authenticate_user(). The true/false authentication mechanism comes from the following line:

$authenticated = phpbb_api_authenticate_user();

(this returns true when the user connects with the right all-lowercase login and false when the username in phpbb_users is not all lowercase).

phpbb_api_authenticate_user() is defined in includes/phpbb_api.php and only calls phpbb_api_session_begin(), then returns the value of "getBridge()->authenticateUser();", which then goes to includes/phpbbvbridge/PhpbbVBridgeApp.php, which seems to decide everything through a call to $user->session_begin() on line 78, which is called directly from phpBB3/includes/session.php (inside the phpBB code!).

It then (when the authentication fails) gets up to line 402 of phpbb/includes/session.php (if(!$session_expired)) {...), passes the following condition and sets $this->data['is_registered'] to false because the $this->data['user_id'] = 1, which is equivalent to ANONYMOUS, which is equivalent to no drupal user being connected. There's still one step I'm missing.

The query executed at the beginning of session_begin() checks the existence of a specific session, *NOT* of a specific username (line 323): SELECT u.*, s.*\n\t\t\t\tFROM phpbb_sessions s, phpbb_users u\n\t\t\t\tWHERE s.session_id = 'a0fd67d87b89593c27280e78c440d371'\n\t\t\t\t\tAND u.user_id = s.session_user_id.
It gets the session_id from the $this->session_id property. Apparently, this property is filled with the _sid para from the previous form (it looks for it in GET and POST).

This obviously implies the username is checked before that (or isn't checked at all).

ywarnier’s picture

Apparently putting all contents of username_clean in lowercase and assigning passwords longer than 7 characters solved the problem for now (which doesn't really close the problem anyway)

demon326’s picture

@ywarnier: Good to hear you have found a workaround, but i agree, this should be fixed asap because this is site breaking, same with the site offline bug...

ywarnier’s picture

I found I could really have fixed it if the inline documentation was a bit better in terms of defining where the global variables used actually come from. Currently it's very difficult to find one's way. It took me about 4 hours to really get into it, then 2 hours more to test things and then I had to switch to another, more urgent task, so really, these were 6 lost hours, where I could have sent a nice patch that might have solved the issue. Too bad...

fizk’s picture

Status: Active » Closed (fixed)