From ebde411e6126447c0dae0cccf7100146f615f27c Mon Sep 17 00:00:00 2001 From: Chris Date: Wed, 20 Apr 2016 09:05:31 +1200 Subject: [PATCH] Bug 16282 : Make check_pw_internal case sensitve for user names To test: 1/ Make a user with a username like Fish 2/ Login to OPAC and staff side, test you can login with username fish, FISH, FIsh etc 3/ Apply patch, set UsernamesCaseSensitive to No 4/ Login again to OPAC and staff side, test you can still use fish, FISH 5/ Set syspref to Yes 6/ Try logging in with fish, note you cant 7/ Login with Fish successfully --- C4/Auth.pm | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index bff7fcd..8c690a1 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1790,12 +1790,20 @@ sub checkpw_internal { return 0; } } - - my $sth = + my $sth; + if ( C4::Context->preference('UsernamesCaseSensitive') ){ + # This query does a case sensitive query, but it first does a insensitive one so that the index can still be used + # This will mean we don't get a nasty performance hit + $sth = $dbh->prepare("SELECT * FROM (SELECT password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags FROM borrowers JOIN branches ON borrowers.branchcode=branches.branchcode WHERE userid= ?) AS firstpass WHERE BINARY userid = ?"); + $sth->execute($userid,$userid); + } + else { + $sth = $dbh->prepare( - "select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where userid=?" + "SELECT password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags FROM borrowers JOIN branches ON borrowers.branchcode=branches.branchcode WHERE userid=?" ); - $sth->execute($userid); + $sth->execute($userid); + } if ( $sth->rows ) { my ( $stored_hash, $cardnumber, $borrowernumber, $userid, $firstname, $surname, $branchcode, $branchname, $flags ) -- 1.7.10.4