$result = db_query("SELECT uid FROM {users} WHERE mail = '%s'", $order->primary_email);

This check will fail if database compares strings in case sensitive manner. Must be
WHERE LOWER(mail) = LOWER('%s')

There's one more similar check in uc_order_select_customer() function:

$result = db_query("SELECT uid, mail FROM {users} WHERE mail = '%s'", $email);
CommentFileSizeAuthor
#3 ubercart-email-ci.patch1.42 KBmaximpodorov

Comments

longwave’s picture

Priority: Critical » Normal

This is not "critical".

maximpodorov’s picture

Priority: Normal » Major

Excuse me, it's critical, since this bug can produce new users having e-mail addresses already presented in users table (Drupal core will confuse, since it considers emails as case insensitive).

maximpodorov’s picture

StatusFileSize
new1.42 KB

Here's the patch to solve this issue.

longwave’s picture

Status: Active » Needs review
longwave’s picture

Version: 6.x-2.x-dev » 7.x-3.x-dev
Status: Needs review » Patch (to be ported)

Committed to 6.x.

This needs revisiting in 7.x, as LOWER() is no longer used in D7 core; see #280310: Force {users}.mail to lowercase for further discussion, and #279851: Replace LOWER() with db_select() and LIKE() where possible may be an alternative.

longwave’s picture

Status: Patch (to be ported) » Fixed

We are already using LIKE in uc_checkout_pane_customer() in 7.x, so I just copied the same query to uc_cart_complete_sale().

http://drupalcode.org/project/ubercart.git/commitdiff/2b05686

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.