diff --git a/store/sqlstore/user_store.go b/store/sqlstore/user_store.go index 9411dcbd81..2ee03bda43 100644 --- a/store/sqlstore/user_store.go +++ b/store/sqlstore/user_store.go @@ -273,8 +273,6 @@ func (us SqlUserStore) UpdateFailedPasswordAttempts(userId string, attempts int) } func (us SqlUserStore) UpdateAuthData(userId string, service string, authData *string, email string, resetMfa bool) (string, *model.AppError) { - email = strings.ToLower(email) - updateAt := model.GetMillis() query := ` @@ -289,7 +287,7 @@ func (us SqlUserStore) UpdateAuthData(userId string, service string, authData *s AuthData = :AuthData` if len(email) != 0 { - query += ", Email = :Email" + query += ", Email = lower(:Email)" } if resetMfa { @@ -1052,9 +1050,7 @@ func (us SqlUserStore) GetSystemAdminProfiles() (map[string]*model.User, *model. } func (us SqlUserStore) GetByEmail(email string) (*model.User, *model.AppError) { - email = strings.ToLower(email) - - query := us.usersQuery.Where("Email = ?", email) + query := us.usersQuery.Where("Email = lower(?)", email) queryString, args, err := query.ToSql() if err != nil { @@ -1129,7 +1125,7 @@ func (us SqlUserStore) GetAllNotInAuthService(authServices []string) ([]*model.U } func (us SqlUserStore) GetByUsername(username string) (*model.User, *model.AppError) { - query := us.usersQuery.Where("u.Username = ?", username) + query := us.usersQuery.Where("u.Username = lower(?)", username) queryString, args, err := query.ToSql() if err != nil { @@ -1147,11 +1143,11 @@ func (us SqlUserStore) GetByUsername(username string) (*model.User, *model.AppEr func (us SqlUserStore) GetForLogin(loginId string, allowSignInWithUsername, allowSignInWithEmail bool) (*model.User, *model.AppError) { query := us.usersQuery if allowSignInWithUsername && allowSignInWithEmail { - query = query.Where("Username = ? OR Email = ?", loginId, loginId) + query = query.Where("Username = lower(?) OR Email = lower(?)", loginId, loginId) } else if allowSignInWithUsername { - query = query.Where("Username = ?", loginId) + query = query.Where("Username = lower(?)", loginId) } else if allowSignInWithEmail { - query = query.Where("Email = ?", loginId) + query = query.Where("Email = lower(?)", loginId) } else { return nil, model.NewAppError("SqlUserStore.GetForLogin", "store.sql_user.get_for_login.app_error", nil, "", http.StatusInternalServerError) } @@ -1180,7 +1176,7 @@ func (us SqlUserStore) GetForLogin(loginId string, allowSignInWithUsername, allo func (us SqlUserStore) VerifyEmail(userId, email string) (string, *model.AppError) { curTime := model.GetMillis() - if _, err := us.GetMaster().Exec("UPDATE Users SET Email = :email, EmailVerified = true, UpdateAt = :Time WHERE Id = :UserId", map[string]interface{}{"email": email, "Time": curTime, "UserId": userId}); err != nil { + if _, err := us.GetMaster().Exec("UPDATE Users SET Email = lower(:email), EmailVerified = true, UpdateAt = :Time WHERE Id = :UserId", map[string]interface{}{"email": email, "Time": curTime, "UserId": userId}); err != nil { return "", model.NewAppError("SqlUserStore.VerifyEmail", "store.sql_user.verify_email.app_error", nil, "userId="+userId+", "+err.Error(), http.StatusInternalServerError) } diff --git a/store/storetest/user_store.go b/store/storetest/user_store.go index 802c398bef..c8f88c7ecc 100644 --- a/store/storetest/user_store.go +++ b/store/storetest/user_store.go @@ -1845,6 +1845,7 @@ func testUserStoreGetForLogin(t *testing.T, ss store.Store) { AuthService: model.USER_AUTH_SERVICE_GITLAB, AuthData: &auth, }) + require.Nil(t, err) defer func() { require.Nil(t, ss.User().PermanentDelete(u1.Id)) }() _, nErr := ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: u1.Id}, -1) @@ -1886,6 +1887,12 @@ func testUserStoreGetForLogin(t *testing.T, ss store.Store) { assert.Equal(t, u1, user) }) + t.Run("get u1 by username, check for case issues", func(t *testing.T) { + user, err := ss.User().GetForLogin(strings.ToUpper(u1.Username), true, true) + require.Nil(t, err) + assert.Equal(t, u1, user) + }) + t.Run("get u1 by username, allow only email", func(t *testing.T) { _, err := ss.User().GetForLogin(u1.Username, false, true) require.NotNil(t, err) @@ -1898,6 +1905,12 @@ func testUserStoreGetForLogin(t *testing.T, ss store.Store) { assert.Equal(t, u1, user) }) + t.Run("get u1 by email, check for case issues", func(t *testing.T) { + user, err := ss.User().GetForLogin(strings.ToUpper(u1.Email), true, true) + require.Nil(t, err) + assert.Equal(t, u1, user) + }) + t.Run("get u1 by email, allow only username", func(t *testing.T) { _, err := ss.User().GetForLogin(u1.Email, true, false) require.NotNil(t, err)