DbUserBackend: Lowercase usernames before fetching password hashes

The BINARY cast to make trailing spaces significant (#4030) also
made these queries case-sensitive. This wasn't identified at the
time because the query itself wasn't case-insensitive, but the
default collation on the `name` column. (Tests sometimes are the
perfect mitigation for this...)

fixes #4184
This commit is contained in:
Johannes Meyer 2020-06-19 09:23:06 +02:00
parent 38e585222e
commit 4d173e6746
1 changed files with 7 additions and 1 deletions

View File

@ -184,9 +184,15 @@ class DbUserBackend extends DbRepository implements UserBackendInterface, Inspec
$columns = array('password_hash');
}
$nameColumn = 'name';
if ($this->ds->getDbType() === 'mysql') {
$username = strtolower($username);
$nameColumn = 'BINARY LOWER(name)';
}
$query = $this->ds->select()
->from($this->prependTablePrefix('user'), $columns)
->where(($this->ds->getDbType() === 'mysql' ? 'BINARY ' : '') . 'name', $username)
->where($nameColumn, $username)
->where('active', true);
$statement = $this->ds->getDbAdapter()->prepare($query->getSelectQuery());