Mahara

The webservice mahara_view_external.php looks to check for a user wrong

Bug #1966367 reported by Robert Lyon
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Fix Released
High
Doris Tam
Mahara 22.04.0
20.10
Fix Released
High
Unassigned
Mahara 20.10.5
21.04
Fix Released
High
Unassigned
Mahara 21.04.4
21.10
Fix Released
High
Unassigned
Mahara 21.10.2
22.04
Fix Released
High
Doris Tam
Mahara 22.04.0

Bug Description

We store username and email in Mahara in lowercase and therefore compare passed in username or email against the database as lowercase versions.

However in webservices it looks like we don't do that and just compare what is passed in so if we have $value['username'] = 'ExamplePerson' it won't match on the person in the database with 'exampleperson' but it should as usernames are lowercase unique in the database.

Need to update the checkuser() functions in
webservice/functions/mahara_institution_external.php
webservice/functions/mahara_user_external.php
webservice/functions/mahara_view_external.php
webservice/functions/mahara_blog_external.php

So that those functions check the username and email in a lowercase fashion

Robert Lyon (robertl-9)
Changed in mahara:
importance: Undecided → High
assignee: nobody → Doris Tam (doristam)
milestone: none → 22.04.0
status: New → Confirmed
Revision history for this message
Kristina Hoeppner (kris-hoeppner) wrote :

https://reviews.mahara.org/c/mahara/+/12525

Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/c/mahara/+/12525
Committed: https://git.mahara.org/mahara/mahara/commit/00659a95055839d797968bcb3c946f1014b2bfeb
Submitter: "Robert Lyon <email address hidden>"
Branch: main

commit 00659a95055839d797968bcb3c946f1014b2bfeb
Author: Doris Tam <email address hidden>
Date: Tue Mar 29 18:19:45 2022 +1300

Bug 1966367: Add strtolower for username, email, and remoteuser checks in webservices

Change-Id: Ie6c9ca818939c69761b1b0d2e71217f2584e9ba4

Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "21.10_DEV" branch: https://reviews.mahara.org/c/mahara/+/12560

Revision history for this message
Mahara Bot (dev-mahara) wrote :

Patch for "21.04_DEV" branch: https://reviews.mahara.org/c/mahara/+/12580

Revision history for this message
Mahara Bot (dev-mahara) wrote :

Patch for "20.10_DEV" branch: https://reviews.mahara.org/c/mahara/+/12581

Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/c/mahara/+/12580
Committed: https://git.mahara.org/mahara/mahara/commit/c6930c173c6399ebdd3e6a34c41e637f8ced045d
Submitter: "Robert Lyon <email address hidden>"
Branch: 21.04_DEV

commit c6930c173c6399ebdd3e6a34c41e637f8ced045d
Author: Doris Tam <email address hidden>
Date: Tue Mar 29 18:19:45 2022 +1300

Bug 1966367: Add strtolower for username, email, and remoteuser checks in webservices

Change-Id: Ie6c9ca818939c69761b1b0d2e71217f2584e9ba4
(cherry picked from commit 00659a95055839d797968bcb3c946f1014b2bfeb)

Revision history for this message
Mahara Bot (dev-mahara) wrote :

Reviewed: https://reviews.mahara.org/c/mahara/+/12560
Committed: https://git.mahara.org/mahara/mahara/commit/731471b5c3f2f2065905e809797c50b6d3fd69e3
Submitter: "Robert Lyon <email address hidden>"
Branch: 21.10_DEV

commit 731471b5c3f2f2065905e809797c50b6d3fd69e3
Author: Doris Tam <email address hidden>
Date: Tue Mar 29 18:19:45 2022 +1300

Bug 1966367: Add strtolower for username, email, and remoteuser checks in webservices

Change-Id: Ie6c9ca818939c69761b1b0d2e71217f2584e9ba4
(cherry picked from commit 00659a95055839d797968bcb3c946f1014b2bfeb)

Revision history for this message
Mahara Bot (dev-mahara) wrote :

Reviewed: https://reviews.mahara.org/c/mahara/+/12581
Committed: https://git.mahara.org/mahara/mahara/commit/07d5836ac1d8150dbd03249e925829b2511cda4b
Submitter: "Robert Lyon <email address hidden>"
Branch: 20.10_DEV

commit 07d5836ac1d8150dbd03249e925829b2511cda4b
Author: Doris Tam <email address hidden>
Date: Tue Mar 29 18:19:45 2022 +1300

Bug 1966367: Add strtolower for username, email, and remoteuser checks in webservices

Change-Id: Ie6c9ca818939c69761b1b0d2e71217f2584e9ba4
(cherry picked from commit 00659a95055839d797968bcb3c946f1014b2bfeb)

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.