$result = db_query("SELECT uid FROM {users} WHERE mail = '%s'", $order->primary_email);
This check will fail if database compares strings in case sensitive manner. Must be
WHERE LOWER(mail) = LOWER('%s')
There's one more similar check in uc_order_select_customer() function:
$result = db_query("SELECT uid, mail FROM {users} WHERE mail = '%s'", $email);
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | ubercart-email-ci.patch | 1.42 KB | maximpodorov |
Comments
Comment #1
longwaveThis is not "critical".
Comment #2
maximpodorov commentedExcuse me, it's critical, since this bug can produce new users having e-mail addresses already presented in users table (Drupal core will confuse, since it considers emails as case insensitive).
Comment #3
maximpodorov commentedHere's the patch to solve this issue.
Comment #4
longwaveComment #5
longwaveCommitted to 6.x.
This needs revisiting in 7.x, as LOWER() is no longer used in D7 core; see #280310: Force {users}.mail to lowercase for further discussion, and #279851: Replace LOWER() with db_select() and LIKE() where possible may be an alternative.
Comment #6
longwaveWe are already using LIKE in uc_checkout_pane_customer() in 7.x, so I just copied the same query to uc_cart_complete_sale().
http://drupalcode.org/project/ubercart.git/commitdiff/2b05686