From 718c0e1c6d965ffe3c7e2586b22b0e205697392f Mon Sep 17 00:00:00 2001
From: Dave Miller <justdave@bugzilla.org>
Date: Thu, 29 Aug 2024 07:06:04 -0400
Subject: [PATCH] Bug 1813629: Prevent Auth plugins from authenticating
 usernames with unicode variants

Co-authored-by: David Lawrence <dkl@mozilla.com>
---
 Bugzilla/User.pm | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index b33c39748..63faac032 100644
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -131,7 +131,19 @@ sub new {
       $_[0] = $param;
     }
   }
-  return $class->SUPER::new(@_);
+
+  $user = $class->SUPER::new(@_);
+
+  # MySQL considers some non-ascii characters such as umlauts to equal
+  # ascii characters returning a user when it should not.
+  if ($user && ref $param eq 'HASH' && exists $param->{name}) {
+    my $login = $param->{name};
+    if (lc $login ne lc $user->login) {
+      $user = undef;
+    }
+  }
+
+  return $user;
 }
 
 sub super_user {
-- 
2.47.3