Log in with username/password: lyceum/lyceum

Ticket #475 (closed defect: fixed)

Opened 2 years ago

Last modified 2 years ago

user names are case sensitive

Reported by: ageller@gmail.com Assigned to: jjb
Priority: normal Milestone: 0.32
Keywords: Cc:

Description

Ideally, they should not be case sensitive, but if they are, then there should be some type of notation on the log in screen.

Change History

05/27/06 16:02:57 changed by jjb

i agree. they should be all lower case, all the time. from /profile, users can control how they appear, so customization isn't really necessary.

i think usernames can currently have spaces as well... kind of disturbing.

05/27/06 16:54:32 changed by jjb

adam--

what do you mean by "some type of notation on the log in screen."?

05/27/06 17:04:14 changed by jjb

hmm... it seems that i can't register both 'john' and 'John'... or do you mean, i shouldn't even be able to register 'John', it should be forced down to 'john'? this vaguely apeals to me at a data level but would not offer any benefits that i can think of. what are your thoughts?

05/27/06 17:30:36 changed by jjb

changeset:762

There are still some UI kinks but the core functionality is there.

05/27/06 17:30:41 changed by jjb

  • status changed from new to closed.
  • resolution set to fixed.

05/27/06 20:07:58 changed by adam

  • status changed from closed to reopened.
  • resolution deleted.

1. Some type of notation: if usernames were going to be allowed to be case-sensitive, then there should be a note on the login screen that says "User names are case-sensitive"

2. I think that if I want to register as JoHN, then that's all good and well. When I go to log in, though, it should recognize the user whether he types in JOHN or john or JOhn.

3. I see where you modded the code. This, however, does not address my concern. Even if the system now automatically forces a username into lowercase, the most important thing is recognizing any variant capitalization in the username area of the login prompt. I'm still getting a login error on my already established user account when I don't login with the exact capitalization used during registration.

Here's what I suggest:

  1. At registration, the user enters in any desired name which we'll call variable N.
  2. N has changeset:762 run on it and is now stored as var X.
  3. X goes through the normal checks (already in place) to ensure that the username does not conflict with another on the system. X (an all lower caps var) is written as the new username.
  4. N is copied (preserving original capitalization) to the nickname field of the db (as happens now).
  5. A new script is created to handle the login box, automatically converting the entered text to lowercase to match how it would be stored in the db.

All this assumes that we leave changeset:762 in place. An alternative is to just design the duplicate user check and login box username lookup to a non-case-sensitive process.

Why this is important to tighten up: Imagine two people register John and john. John has an awesome blog. "john" can go in and maliciously leave comments all over the "John" blog and have it appear that it is the same person. Many users would not pick up on the subtle difference.

A parallel situation: AOL instant messenger names. Can be formatted (capitalization and spacing) any which way, but the character sequence is protected from duplication to avoid impersonation.

05/29/06 15:30:20 changed by jjb

adam-

thanks for all your thoughts.

i think the only difference between current behavior, and what you propose, is arbitray case when logging in. am i correct?

john

05/29/06 21:45:33 changed by jjb

from adam:

Yes. The arbitrary case when logging in would fix the problem as per my description (as long as the duplicate user name check can handle arbitrary case, too).

05/29/06 23:58:21 changed by jjb

adam-

looks like this is the current behavior. maybe you are not experiencing that becuase your existing usernames have uppercase characters?

05/30/06 00:00:40 changed by jjb

  • status changed from reopened to closed.
  • resolution set to fixed.

looks like everything you laid out in your excellent and helpful write-up is working, except for point 4. I don't see this as a big deal, but if you are really yearning for it, make a separate ticket for milestone .40 :)

05/30/06 01:27:54 changed by adam

Update: The duplicate user check that runs when registering a new user seems case insensitive. I believe I can not register John and john. This is good.

"looks like this is the current behavior. maybe you are not experiencing that becuase your existing usernames have uppercase characters?"

current behavior as it would be in the nightly or in the .31 demo? in the demo, i am getting this problem. my user name (when registered) did use an uppercase letter. my password for username "userOne" will not work on "userone".

"looks like everything you laid out in your excellent and helpful write-up is working, except for point 4."

what exactly is point 4?

06/01/06 03:18:46 changed by ageller

  • status changed from closed to reopened.
  • resolution deleted.

i just happened to need to reference this ticket. noticed no response to the continued comments b/c it was closed.

after re-reading your point 4... were you meaning point 3 which referenced a case-insensitive log-in mod?

06/01/06 04:37:11 changed by jjb

  • status changed from reopened to closed.
  • resolution set to fixed.

"current behavior as it would be in the nightly or in the .31 demo?"

nightly

"after re-reading your point 4... were you meaning point 3 which referenced a case-insensitive log-in mod?"

no

Log in with username/password: lyceum/lyceum