sigb.us/dendrite
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases 1 Wiki Activity

Allow uppercase username on login (#2126)

Browse source 
* ADD jetstream folder to gitignore

* CHANGE login to check on uppercase if lowercase not exists

Co-authored-by: kegsay <kegan@matrix.org>
This commit is contained in:
Hoernschen 2022-01-31 14:44:52 +01:00 committed by GitHub
parent f9547a53d2
commit 1d5fd99cad
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored
View file

@ -23,6 +23,7 @@
/vendor/bin /vendor/bin
/docker/build /docker/build
/logs /logs
/jetstream
# Architecture specific extensions/prefixes # Architecture specific extensions/prefixes
*.[568vq] *.[568vq]

13
clientapi/auth/password.go
View file

@ -16,6 +16,7 @@ package auth
import ( import (
"context" "context"
"database/sql"
"net/http" "net/http"
"strings" "strings"
@ -49,8 +50,7 @@ func (t *LoginTypePassword) Request() interface{} {
func (t *LoginTypePassword) Login(ctx context.Context, req interface{}) (*Login, *util.JSONResponse) { func (t *LoginTypePassword) Login(ctx context.Context, req interface{}) (*Login, *util.JSONResponse) {
r := req.(*PasswordRequest) r := req.(*PasswordRequest)
// Squash username to all lowercase letters username := r.Username()
username := strings.ToLower(r.Username())
if username == "" { if username == "" {
return nil, &util.JSONResponse{ return nil, &util.JSONResponse{
Code: http.StatusUnauthorized, Code: http.StatusUnauthorized,
@ -64,8 +64,15 @@ func (t *LoginTypePassword) Login(ctx context.Context, req interface{}) (*Login,
JSON: jsonerror.InvalidUsername(err.Error()), JSON: jsonerror.InvalidUsername(err.Error()),
} }
} }
_, err = t.GetAccountByPassword(ctx, localpart, r.Password) // Squash username to all lowercase letters
_, err = t.GetAccountByPassword(ctx, strings.ToLower(localpart), r.Password)
if err != nil { if err != nil {
if err == sql.ErrNoRows {
_, err = t.GetAccountByPassword(ctx, localpart, r.Password)
if err == nil {
return &r.Login, nil
}
}
// Technically we could tell them if the user does not exist by checking if err == sql.ErrNoRows // Technically we could tell them if the user does not exist by checking if err == sql.ErrNoRows
// but that would leak the existence of the user. // but that would leak the existence of the user.
return nil, &util.JSONResponse{ return nil, &util.JSONResponse{