diff --git a/api/modules/session/models/JoinForm.php b/api/modules/session/models/JoinForm.php index b8b2aff..2676fb2 100644 --- a/api/modules/session/models/JoinForm.php +++ b/api/modules/session/models/JoinForm.php @@ -134,7 +134,7 @@ class JoinForm extends Model { throw new ForbiddenOperationException('Wrong selected_profile.'); } - if (!$isUuid && $account->username !== $selectedProfile) { + if (!$isUuid && mb_strtolower($account->username) !== mb_strtolower($selectedProfile)) { Session::error( "User with access_token = '{$accessToken}' trying to join with identity = '{$selectedProfile}'," . " but access_token issued to account with username = '{$account->username}'." diff --git a/tests/codeception/api/functional/sessionserver/JoinLegacyCest.php b/tests/codeception/api/functional/sessionserver/JoinLegacyCest.php index a04cbc0..27fe28c 100644 --- a/tests/codeception/api/functional/sessionserver/JoinLegacyCest.php +++ b/tests/codeception/api/functional/sessionserver/JoinLegacyCest.php @@ -30,6 +30,17 @@ class JoinLegacyCest { $this->expectSuccessResponse($I); } + public function joinByOauth2TokenAndDifferentLetterCase(AuthserverSteps $I) { + $I->wantTo('join to server by legacy protocol, using legacy authserver access token and different letter case'); + [$accessToken] = $I->amAuthenticated(); + $this->route->joinLegacy([ + 'sessionId' => $accessToken, + 'user' => 'admin', + 'serverId' => Uuid::uuid(), + ]); + $this->expectSuccessResponse($I); + } + public function joinByNewSessionFormat(AuthserverSteps $I) { $I->wantTo('join to server by legacy protocol with new launcher session format, using legacy authserver'); [$accessToken] = $I->amAuthenticated();