Fixes underscore treated as wildcard in emails #178
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The 'nocase' modifier must use a LIKE query under
the hood, at least in MySQL backends. Emails like
'me2@me.com' and 'm_2@me.com' should not match,
but they do with `filter('Email:nocase'`
|
That is probably more a framework issue. |
|
Agreed, nocase should escape underscores using a backslash most likely. However, this library needs to ensure that a lookup for an email address doesn't accidentally match someone else's email as well I think? |
|
Yes, thought when fixed in the framework this problem wouldn't exist here. Or is there more to it than the likely required escaping? |
|
Raised issue on Silverstripe Framework: silverstripe/silverstripe-framework#10074 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In a project we are using this module, and having issues with users unable to sign up if their email address has an underscore in it and closely matches an existing email in the system. After a bit of digging, I found that the LIKE operator in Postgres and MySQL uses underscore as a single character wildcard.
It seems the SilverStripe ORM's 'nocase' modifier must use a LIKE query under the hood, at least in MySQL backends.
Email addresses like 'me2@me.com' and 'm_2@me.com' should not match, but they do with
filter('Email:nocase'