My-Little-Forum / mylittleforum

A simple PHP and MySQL based internet forum that displays the messages in classical threaded view (tree structure)
GNU General Public License v3.0
124 stars 48 forks source link

Check for existing user name is inaccurate #750

Open auge8472 opened 4 weeks ago

auge8472 commented 4 weeks ago

If I, as a forum administrator, want to edit a posting of a not registered visitor with the same name as a registered user, I get an error message after submitting my changes, that tells me, that the author name is in use by another registered user. To be more precise, in this case the error is triggered by the fact that the user who wrote the post has registered after writing the post in question, thereby blocking the username from being used by other users. It could just as well be that they are obviously two different people. That is the same thing in the endeffent.

Now, when I tried to edit the post, I was hit by this lock.

The check as it is implemented only asks for the user name.

SELECT
    user_id,
    user_name
FROM mlf2_userdata
WHERE lower(user_name) = 'john doe'" -- the value also gets lowered

It IMHO also should compare the posting time with the time of registration because the name may have been in use before.

SELECT
    user_id,
    user_name
FROM mlf2_userdata
WHERE lower(user_name) = 'john doe'
    AND registered > 'posting_time'" -- check for registration after the time of posting creation

Have I missed anything?

loesler commented 3 weeks ago