Uppercase letters in username break reachable mention check in composer

Nice find @thoka !

The problem is here

users returns {"username_lower" => User object }

However if name is not downcased, users[name] does not exist.

Fix:

if user = users[name.downcase]
...
elsif group = groups[name.downcase]
...

Or better: downcase all names at the start of the method because there are a lot of issues in there, groups nicely does .where("lower(name) IN (?)", @names.map(&:downcase)) but functions like visible_group_ids_for_allowed_check, topic_allowed_group_ids, mentionable_group_ids and members_visible_group_ids all do where(name: @names) which introduces case sensitivity issues as well.

3 Likes