large and lower case usernames generates user

[Dennis1993]

PHP 5.6.16
RoundCube 1.1.4

If I log in with username "dennis" I can perform the login. In the table "users" is now a entry with "dennis" as username available. That's correct!
If I log in with username "Dennis", roundcube creates a new user in the table "users" and all my settings are lost (signatures, identities etc.)
Now I can login with different large and lower case users (e.g. dEnnis, deNnis, denNis, DenNiS...) and create different entries for the same user!

[SKaero]

You can set login_lc in the Roundcube config to correct the problem. Believe it or not upper and lower case can actually matter in an email, [email protected] and [email protected] can be two completely different email accounts. Why anyone would actually setup a system that way is beyond me.

Code Select Expand


// Forces conversion of logins to lower case.
// 0 - disabled, 1 - only domain part, 2 - domain and local part.
// If users authentication is case-insensitive this must be enabled.
// Note: After enabling it all user records need to be updated, e.g. with query:
//       UPDATE users SET username = LOWER(username);
$config['login_lc'] = 2;