Disallow users and repositories which have different letter cases

This commit is contained in:
Naoki Takezoe
2018-04-13 15:29:22 +09:00
parent 5cb26247fc
commit b4cf4bfb17
5 changed files with 14 additions and 6 deletions

View File

@@ -715,7 +715,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
private def existsAccount: Constraint = new Constraint() { private def existsAccount: Constraint = new Constraint() {
override def validate(name: String, value: String, messages: Messages): Option[String] = override def validate(name: String, value: String, messages: Messages): Option[String] =
if (getAccountByUserName(value).isEmpty) Some("User or group does not exist.") else None if (getAccountByUserNameIgnoreCase(value).isEmpty) Some("User or group does not exist.") else None
} }
private def uniqueRepository: Constraint = new Constraint() { private def uniqueRepository: Constraint = new Constraint() {
@@ -727,7 +727,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
): Option[String] = { ): Option[String] = {
for { for {
userName <- params.optionValue("owner") userName <- params.optionValue("owner")
_ <- getRepositoryNamesOfUser(userName).find(_ == value) _ <- getRepositoryNamesOfUser(userName).find(_.equalsIgnoreCase(value))
} yield { } yield {
"Repository already exists." "Repository already exists."
} }

View File

@@ -349,7 +349,7 @@ trait AccountManagementControllerBase extends ControllerBase {
protected def uniqueUserName: Constraint = new Constraint() { protected def uniqueUserName: Constraint = new Constraint() {
override def validate(name: String, value: String, messages: Messages): Option[String] = override def validate(name: String, value: String, messages: Messages): Option[String] =
getAccountByUserName(value, true).map { _ => getAccountByUserNameIgnoreCase(value, true).map { _ =>
"User already exists." "User already exists."
} }
} }
@@ -386,9 +386,10 @@ trait AccountManagementControllerBase extends ControllerBase {
"groups", "groups",
"new" "new"
) )
protected def reservedNames(): Constraint = new Constraint() { protected def reservedNames(): Constraint = new Constraint() {
override def validate(name: String, value: String, messages: Messages): Option[String] = override def validate(name: String, value: String, messages: Messages): Option[String] =
if (allReservedNames.contains(value)) { if (allReservedNames.contains(value.toLowerCase)) {
Some(s"${value} is reserved") Some(s"${value} is reserved")
} else { } else {
None None

View File

@@ -222,7 +222,7 @@ trait IndexControllerBase extends ControllerBase {
* Returns a single string which is any of "group", "user" or "". * Returns a single string which is any of "group", "user" or "".
*/ */
post("/_user/existence")(usersOnly { post("/_user/existence")(usersOnly {
getAccountByUserName(params("userName")).map { account => getAccountByUserNameIgnoreCase(params("userName")).map { account =>
if (account.isGroupAccount) "group" else "user" if (account.isGroupAccount) "group" else "user"
} getOrElse "" } getOrElse ""
}) })

View File

@@ -95,6 +95,13 @@ trait AccountService {
def getAccountByUserName(userName: String, includeRemoved: Boolean = false)(implicit s: Session): Option[Account] = def getAccountByUserName(userName: String, includeRemoved: Boolean = false)(implicit s: Session): Option[Account] =
Accounts filter (t => (t.userName === userName.bind) && (t.removed === false.bind, !includeRemoved)) firstOption Accounts filter (t => (t.userName === userName.bind) && (t.removed === false.bind, !includeRemoved)) firstOption
def getAccountByUserNameIgnoreCase(userName: String, includeRemoved: Boolean = false)(
implicit s: Session
): Option[Account] =
Accounts filter (
t => (t.userName.toLowerCase === userName.toLowerCase.bind) && (t.removed === false.bind, !includeRemoved)
) firstOption
def getAccountsByUserNames(userNames: Set[String], knowns: Set[Account], includeRemoved: Boolean = false)( def getAccountsByUserNames(userNames: Set[String], knowns: Set[Account], includeRemoved: Boolean = false)(
implicit s: Session implicit s: Session
): Map[String, Account] = { ): Map[String, Account] = {

View File

@@ -32,7 +32,7 @@ isCreateRepoOptionPublic: Boolean)(implicit context: gitbucket.core.controller.C
<dl> <dl>
<dt>Repository name</dt> <dt>Repository name</dt>
<dd style="margin-left: 0px;"> <dd style="margin-left: 0px;">
<input type="text" name="name" id="name" class="form-control" style="width: 200px;" autofocus /> <input type="text" name="name" id="name" class="form-control" style="width: 200px; display: inline;" autofocus/>
<span id="error-name" class="error"></span> <span id="error-name" class="error"></span>
</dd> </dd>
</dl> </dl>