Skip to content
Snippets Groups Projects
Commit fd16784b authored by Daniel's avatar Daniel
Browse files

fix bug where users could use wildcards in username to login

e.g. user Peter could probably login using username Pet%
fixed same problem in the migration script
parent 44c34115
No related branches found
No related tags found
No related merge requests found
......@@ -457,7 +457,7 @@ class OC_Migrate{
);
// Add hash if user export
if( self::$exporttype == 'user' ){
$query = OC_DB::prepare( "SELECT password FROM *PREFIX*users WHERE uid LIKE ?" );
$query = OC_DB::prepare( "SELECT password FROM *PREFIX*users WHERE uid = ?" );
$result = $query->execute( array( self::$uid ) );
$row = $result->fetchRow();
$hash = $row ? $row['password'] : false;
......
......@@ -122,7 +122,7 @@ class OC_User_Database extends OC_User_Backend {
* Check if the password is correct without logging in the user
*/
public function checkPassword( $uid, $password ){
$query = OC_DB::prepare( "SELECT uid, password FROM *PREFIX*users WHERE uid LIKE ?" );
$query = OC_DB::prepare( "SELECT uid, password FROM *PREFIX*users WHERE uid = ?" );
$result = $query->execute( array( $uid));
$row=$result->fetchRow();
......@@ -172,7 +172,7 @@ class OC_User_Database extends OC_User_Backend {
* @return boolean
*/
public function userExists($uid){
$query = OC_DB::prepare( "SELECT * FROM `*PREFIX*users` WHERE uid LIKE ?" );
$query = OC_DB::prepare( "SELECT * FROM `*PREFIX*users` WHERE uid = ?" );
$result = $query->execute( array( $uid ));
return $result->numRows() > 0;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment