Moodle

Uppercase letters are not allowed in the username

Details

  • Type: New Feature New Feature
  • Status: Open Open
  • Priority: Major Major
  • Resolution: Unresolved
  • Affects Version/s: 1.8, 1.9
  • Fix Version/s: DEV backlog
  • Component/s: Authentication
  • Labels:
  • Environment:
    Moodle 1.8
  • Database:
    MySQL
  • Affected Branches:
    MOODLE_18_STABLE, MOODLE_19_STABLE

Description

The forcing of lowercase letters in the username has just cropped up in 1.8. Previous versions allowed uppercase letters in the username. Is there a reason for this change? This can cause problems with external authentication for databases, SIS, LDAP and HRMS. This is a major change and there is no documentation on this.
Maybe I missed something?!

  1. adminpatch.diff
    07/Jul/07 10:16 AM
    3 kB
    Scott Tearle
  2. editadvanced_formpatch.diff
    07/Jul/07 10:16 AM
    0.6 kB
    Scott Tearle
  3. securitypatch.diff
    07/Jul/07 10:16 AM
    1.0 kB
    Scott Tearle
  1. username_lowercase copy.jpg
    37 kB
    31/May/07 3:40 AM

Activity

Hide
Petr Škoda (skodak) added a comment -

no, AFAIK it was this way in 1.7 too - each submitted username is lowercased in login/index.php
$frm->username = trim(moodle_strtolower($frm->username));

and the user edit script was doing the same

Show
Petr Škoda (skodak) added a comment - no, AFAIK it was this way in 1.7 too - each submitted username is lowercased in login/index.php $frm->username = trim(moodle_strtolower($frm->username)); and the user edit script was doing the same
Hide
Scott Tearle added a comment -

I just checked a 1.7 installation and it does indeed convert it to lowercase ( I've always used lower case anyway. Probably why it's never been an issue). 1.8 just makes sure the user is told about the lowercase requirement whereas 1.7 does not. I'm still not sure what the reasoning is behind this requirement. Of course I have an ulterior motive in that my client has a naming convention that includes uppercase letters.

Show
Scott Tearle added a comment - I just checked a 1.7 installation and it does indeed convert it to lowercase ( I've always used lower case anyway. Probably why it's never been an issue). 1.8 just makes sure the user is told about the lowercase requirement whereas 1.7 does not. I'm still not sure what the reasoning is behind this requirement. Of course I have an ulterior motive in that my client has a naming convention that includes uppercase letters.
Hide
Michael Penney added a comment -

Just ran into this, also, why are we doing this? Is there some reason for dis-allowing uppercase in usernames?

Show
Michael Penney added a comment - Just ran into this, also, why are we doing this? Is there some reason for dis-allowing uppercase in usernames?
Hide
Scott Tearle added a comment -

I've just turned on extended characters and this does not change the behaviour. I'm still wondering what the rational behind this is as I don't want to override the core code and cause a cascading error.

Show
Scott Tearle added a comment - I've just turned on extended characters and this does not change the behaviour. I'm still wondering what the rational behind this is as I don't want to override the core code and cause a cascading error.
Hide
Petr Škoda (skodak) added a comment -

I do not know the original reason.
The mixed case would be a problem for email signup, on the other hand I understand it may cause problems in some external authentication setups.

Show
Petr Škoda (skodak) added a comment - I do not know the original reason. The mixed case would be a problem for email signup, on the other hand I understand it may cause problems in some external authentication setups.
Hide
Scott Tearle added a comment -

I'm thinking that this should be an option. I don't quite follow you on the email signup as this is just the username, unless you are referring to using email addresses as user names.

Show
Scott Tearle added a comment - I'm thinking that this should be an option. I don't quite follow you on the email signup as this is just the username, unless you are referring to using email addresses as user names.
Hide
Petr Škoda (skodak) added a comment - - edited

Majority of people expect the signup to be case insensitive - Windows usernames are not case sensitive too.
Yes this could be an optional, please submit patches if you solve this issue.

Show
Petr Škoda (skodak) added a comment - - edited Majority of people expect the signup to be case insensitive - Windows usernames are not case sensitive too. Yes this could be an optional, please submit patches if you solve this issue.
Hide
Scott Tearle added a comment -

I'll get on it. Somewhat busy at the moment though. Might not be till 2 weeks from now.

Show
Scott Tearle added a comment - I'll get on it. Somewhat busy at the moment though. Might not be till 2 weeks from now.
Hide
Scott Tearle added a comment - - edited

The files for this patch are:

  • admin/settings/security.php
  • lang/en_utf8/admin.php
  • user/editadvanced_form.php

I've added the check box right under the allow extended characters check box in site policies.

*Note that I applied this to version 1.8.1

Show
Scott Tearle added a comment - - edited The files for this patch are:
  • admin/settings/security.php
  • lang/en_utf8/admin.php
  • user/editadvanced_form.php
I've added the check box right under the allow extended characters check box in site policies. *Note that I applied this to version 1.8.1
Hide
Lim Kai Yang added a comment -

Scott, even you modified the 3 files above, there are still a lot to do. I use external database to link user, it simply create the user in mdl_user with lower case username. There are a lots of works to do

Show
Lim Kai Yang added a comment - Scott, even you modified the 3 files above, there are still a lot to do. I use external database to link user, it simply create the user in mdl_user with lower case username. There are a lots of works to do
Hide
Scott Tearle added a comment -

This was a fix for a user who was registering users via the manual enrolments only. I understand that we need to look at automatically created users from the authentication modules point of view. Unfortunately I don't know when I will get around to this.

Show
Scott Tearle added a comment - This was a fix for a user who was registering users via the manual enrolments only. I understand that we need to look at automatically created users from the authentication modules point of view. Unfortunately I don't know when I will get around to this.
Hide
Richard L. Enison added a comment -

When I saw the code in the very first comment (PS's), I thought this was just a way to make the username case-insensitive. PS's comment of 06 Jul 2007 at 04:57 AM seems to confirm this. If the use of moodle_strtolower is universal, then that's the effect it would have. In that case it should not be a problem at all unless someone wants to have two different users with essentially the same username except for case, e.g., joeshmo and JoeShmo. Am I missing something?

Show
Richard L. Enison added a comment - When I saw the code in the very first comment (PS's), I thought this was just a way to make the username case-insensitive. PS's comment of 06 Jul 2007 at 04:57 AM seems to confirm this. If the use of moodle_strtolower is universal, then that's the effect it would have. In that case it should not be a problem at all unless someone wants to have two different users with essentially the same username except for case, e.g., joeshmo and JoeShmo. Am I missing something?
Hide
Richard L. Enison added a comment -

Once again I wanted to edit my previous comment but there's no edit link.

All I want to add is: aren't e-mail addresses case-insensitive?

Show
Richard L. Enison added a comment - Once again I wanted to edit my previous comment but there's no edit link. All I want to add is: aren't e-mail addresses case-insensitive?
Hide
Iñaki Arenaza added a comment -

> All I want to add is: aren't e-mail addresses case-insensitive?

According to RFCs (821/2821 and 822/2822 are the main refrences here), the local part (the part before the '@') can be case-sensitive (and it usually is in most Un*x-like email servers).

Saludos. Iñaki.

Show
Iñaki Arenaza added a comment - > All I want to add is: aren't e-mail addresses case-insensitive? According to RFCs (821/2821 and 822/2822 are the main refrences here), the local part (the part before the '@') can be case-sensitive (and it usually is in most Un*x-like email servers). Saludos. Iñaki.
Hide
Scott Tearle added a comment -

As I said before, I wrote this for a client who had uppercase letters in their naming convention and were using manual enrolments. When the user was added the name showed up all lower case. The client didn't like this as it was confusing to their users. I added a check box under allow extended characters to give the administrator more flexibility in order to meet their naming conventions.
This is about keeping usernames consistent within the IT environment so as to not confuse your users.
Also some people believe it is important to observe the niceties of punctuation so instead of using 'scott.tearle' you would use 'Scott.Tearle' . ( Personally, it makes no difference to me.)

E-mail addresses may be from an MS Exchange server where there isn't any case sensitivity. (I'm not thrilled about this, but it is a reality)

As far as external authentication mechanisms go, I will not be able to get to them for quite a while.

Show
Scott Tearle added a comment - As I said before, I wrote this for a client who had uppercase letters in their naming convention and were using manual enrolments. When the user was added the name showed up all lower case. The client didn't like this as it was confusing to their users. I added a check box under allow extended characters to give the administrator more flexibility in order to meet their naming conventions. This is about keeping usernames consistent within the IT environment so as to not confuse your users. Also some people believe it is important to observe the niceties of punctuation so instead of using 'scott.tearle' you would use 'Scott.Tearle' . ( Personally, it makes no difference to me.) E-mail addresses may be from an MS Exchange server where there isn't any case sensitivity. (I'm not thrilled about this, but it is a reality) As far as external authentication mechanisms go, I will not be able to get to them for quite a while.
Hide
Jamie Tinley added a comment -

Scott and Inaki,

Do I need to add all three attachments to the moodle code? Also, do I add the entire file or just after it says oldcode? Where do we add it?

Lastly, I found on importing users code in my uploaduser.php has strolower but not what inaki had posted of changing it - see below. Which do I change here in this uploaduser.php file? THanks

James (below by Inaki I think)

Edit file .../moodle/admin/uploaduser.php, and around line 185 you'll see these lines of code:

else if ($name == "username") { $user->username = addslashes(moodle_strtolower($value)); }

just remove the moodle_strlower string and the associated parentheses, so the line reads:

$user->username = addslashes($value);

Show
Jamie Tinley added a comment - Scott and Inaki, Do I need to add all three attachments to the moodle code? Also, do I add the entire file or just after it says oldcode? Where do we add it? Lastly, I found on importing users code in my uploaduser.php has strolower but not what inaki had posted of changing it - see below. Which do I change here in this uploaduser.php file? THanks James (below by Inaki I think) Edit file .../moodle/admin/uploaduser.php, and around line 185 you'll see these lines of code: else if ($name == "username") { $user->username = addslashes(moodle_strtolower($value)); } just remove the moodle_strlower string and the associated parentheses, so the line reads: $user->username = addslashes($value);
Hide
Richard L. Enison added a comment -

JT,

1. Yes, I believe all three patches are to be applied. ST's comment of July 7, 2007 gives the pathnames of the files they apply to.

2. How to apply patches is documented at:

http://docs.moodle.org/en/Development:How_to_apply_a_patch

RLE

Show
Richard L. Enison added a comment - JT, 1. Yes, I believe all three patches are to be applied. ST's comment of July 7, 2007 gives the pathnames of the files they apply to. 2. How to apply patches is documented at: http://docs.moodle.org/en/Development:How_to_apply_a_patch RLE
Hide
Richard L. Enison added a comment -

JT,

3. Where is the IA post you seem to be quoting?

RLE

Show
Richard L. Enison added a comment - JT, 3. Where is the IA post you seem to be quoting? RLE
Hide
Jamie Tinley added a comment -

update - I at least got the underline symbol part of my usernames to work like STU_JohnSmith which it correctly importedthe _ and showed the correct caps too but the final username used lowercase like this: stu_johnsmith ( for those needing symbols: to to admin/SECURITY / site policies has a setting, 'allow extended characters in username" )

Then, by accident, I discovered that when loggin in if you use capital letters it ignores them and still works! I guess two wrongs can make a right sometimes. Still, I wish it would accept capitals when you see your profile under edit.

In answer to where I saw my previous quoted solution by Inaki it was here:
http://moodle.org/mod/forum/discuss.php?d=60360

Also thanks Richard for the link for applying patches. I started this update yesterday before reading your reply.
James

Show
Jamie Tinley added a comment - update - I at least got the underline symbol part of my usernames to work like STU_JohnSmith which it correctly importedthe _ and showed the correct caps too but the final username used lowercase like this: stu_johnsmith ( for those needing symbols: to to admin/SECURITY / site policies has a setting, 'allow extended characters in username" ) Then, by accident, I discovered that when loggin in if you use capital letters it ignores them and still works! I guess two wrongs can make a right sometimes. Still, I wish it would accept capitals when you see your profile under edit. In answer to where I saw my previous quoted solution by Inaki it was here: http://moodle.org/mod/forum/discuss.php?d=60360 Also thanks Richard for the link for applying patches. I started this update yesterday before reading your reply. James
Hide
Mike Churchward added a comment -

The requirement for only lowercase letters, while not a bad idea, just doesn't extend to other systems like LDAP. I think there is no reason for Moodle to do this if the authentication plug-in being used for that user doesn't require it.

I think a lot of the problem could be resolved by moving the part that sets the entered username to lowercase into the authentication functions for the auth plug-ins. Then, the Moodle ones could require case-insensitivity, and others could use case-sensitivity. But it would be up to the plug-in. Unfortunately, this means rewriting a lot of /login/index.php, the authenticate_user_login function and the user_login methods.

I guess a work-around might be to rewrite the 'loginpage_hook' function for a plug-in (like LDAP) that want to be case sensitive to load the $user variable globally and do its login verification there. That would cause the steps that set the username to lowercase to be skipped.

Show
Mike Churchward added a comment - The requirement for only lowercase letters, while not a bad idea, just doesn't extend to other systems like LDAP. I think there is no reason for Moodle to do this if the authentication plug-in being used for that user doesn't require it. I think a lot of the problem could be resolved by moving the part that sets the entered username to lowercase into the authentication functions for the auth plug-ins. Then, the Moodle ones could require case-insensitivity, and others could use case-sensitivity. But it would be up to the plug-in. Unfortunately, this means rewriting a lot of /login/index.php, the authenticate_user_login function and the user_login methods. I guess a work-around might be to rewrite the 'loginpage_hook' function for a plug-in (like LDAP) that want to be case sensitive to load the $user variable globally and do its login verification there. That would cause the steps that set the username to lowercase to be skipped.
Hide
Scott Tearle added a comment -

Up until now we have been changing only those authentication plugins that are being used. This is a bit of a fudge. I'm giving a +1 to this. I'll see if we can free up some resources to help, but frankly, i'm swamped.

Show
Scott Tearle added a comment - Up until now we have been changing only those authentication plugins that are being used. This is a bit of a fudge. I'm giving a +1 to this. I'll see if we can free up some resources to help, but frankly, i'm swamped.
Hide
Iñaki Arenaza added a comment -

Hi Mike,

as far as I know LDAP searches are case insensitive

Saludos,
Iñaki.

Show
Iñaki Arenaza added a comment - Hi Mike, as far as I know LDAP searches are case insensitive Saludos, Iñaki.

Dates

  • Created:
    Updated: