ユーザー名の大文字が作曲者の到達可能なメンションチェックを破損させる

zogstrip · 2026 年 4 月 23 日午前 8:34

正しい修正は

github.com/discourse/discourse

DEV: Use ActiveRecord normalizes for username lookups (#37177)

main ← fix/unicode-username-lookups

closed 02:15AM - 14 Apr 26 UTC

ZogStriP

+159 -164

Leverages Rails' built-in `normalizes` feature to handle username normalization …consistently throughout the codebase. When you call `User.where(username_lower: value)` or `find_by(username_lower: value)`, ActiveRecord now automatically normalizes the input value. Key changes: - Adds `normalizes :username` (unicode normalize) and `normalizes :username_lower` (unicode normalize + downcase) to User - Adds `normalizes :email` (strip + downcase) to UserEmail - Removes manual `.downcase` and `.map(&:downcase)` calls before AR queries - Adds `User#matches_username?` method for comparing usernames - Simplifies `filter_by_username` and `filter_by_username_or_email` scopes to use `ILIKE ANY(ARRAY[?])` instead of branching on array vs single value - Updates `filter_by_username` to normalize input for ILIKE patterns - Updates `find_by_username` to rely on AR normalization - Fixes a SQL injection vulnerability in search user ordering - Uses before_save callback for username_lower assignment to ensure it runs even when validation is skipped (e.g., finish installation flow) - Adds shoulda matcher tests for username normalizations The `normalize_username` class method is kept for cases where AR can't help: raw SQL queries, ILIKE patterns, and direct comparisons. Ref - https://meta.discourse.org/t/393646

ですが、現時点でマージするには変更が大きすぎます

そのため、レビューを簡単にし、リスクを減らすために、各「エンドポイント」を一つずつ修正していく予定です。

まずは最初のステップです

github.com/discourse/discourse

FIX: Make composer mention reachability checks case-insensitive (#39482)

main ← fix-composer-mention-case-sensitivity

opened 08:30AM - 23 Apr 26 UTC

ZogStriP

+200 -190

Mentioning `@SomeUser` in a topic the mentioned user can't see (restricted categ…ory, PM they aren't invited to, topic they've muted) silently skipped the "cannot see this mention" warning popup whenever the typed name contained any uppercase letter. Same for mixed-case group names. Mention validation itself worked because of an existing client-side `.toLowerCase()` workaround, so the bug was easy to miss — mentions stayed `<a class="mention">` but the user got no signal that the mentioned account wouldn't actually be notified. Server side, `ComposerController#mentions` builds its `users` lookup keyed by `username_lower` and `groups` keyed by the case-preserved DB `name`, then iterated `@names.each { |n| users[n] || groups[n] }` without normalizing — so any uppercase character missed both hashes and `user_reasons`/`group_reasons` came back empty. Four downstream group helpers (`mentionable_group_ids`, `members_visible_group_ids`, `topic_allowed_group_ids`, `visible_group_ids_for_allowed_check`) used `where(name: @names)` which is case-sensitive in PostgreSQL, and the `SiteSetting.here_mention` membership test compared raw strings. Client side, `link-mentions.js` cached `foundUsers` / `userReasons` / `foundGroups` / `groupReasons` by the case as typed, and the prosemirror `mention.js` warning lookup did `response.users.includes(name)` plus `response.user_reasons[name]` with the original case — both of which the server only ever returned in the casing it had on hand. Normalize the controller's `@names` and `@allowed_names` once at the top of the action, switch all four group helpers to `LOWER(name) IN (?)`, lower-case the response keys, and lower-case client caches and lookups end to end. Also extract the inline notified-member query into `already_notified_member_count` and tighten the request specs to cover users, mentionable groups, group reasons in PMs, and `allowed_names` (both user and group branches) with mixed-case input. https://meta.discourse.org/t/401292

トピック		返信	表示
Preview is changing casing of @ mentions Bug	1	895	2015 年 6 月 15 日
Rich editor misses usernames with umlauts Bug composer	3	218	2025 年 7 月 29 日
Discobot case-sensitive mentions Bug	2	615	2019 年 5 月 7 日
Highlighting current user and bots in posts UX feedback , design-experiment	3	162	2026 年 3 月 19 日
Capitalization does not match when you open user cards using mentions Bug	12	1049	2022 年 5 月 3 日

ユーザー名の大文字が作曲者の到達可能なメンションチェックを破損させる

関連トピック