Skip to content

[Bug Fix][Validation][Security] Fix working of unique and exists #1196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

manan-jadhav
Copy link
Contributor

@manan-jadhav manan-jadhav commented May 21, 2017

NOTE : This is the same issue as #900

Before this, unique rule was case sensitive, that means it would pass strings with same chars but different case. Example, if [email protected] exists in database, applying unique rule on [email protected] SHOULD have failed, but it does not, since mongo is case sensitive, and case sensitiveness cannot be configured. See laravel/framework#9430. Also seen in #528

I've implemented a DatabasePresenceVerifier for mongodb, which overrides the default presence verifier, ONLY IF ValidationServiceProvider is used. Also added test cases to make sure 'unique' and 'exists' validation rules function in a case insensitive manner.

This is an issue that affects almost all applications that would be using this plugin, and it is pretty serious.

@jenssegers jenssegers merged commit 165bf3a into mongodb:master Jun 26, 2017
@sempixel sempixel mentioned this pull request Oct 11, 2017
@prashant-pokhriyal
Copy link

@CurosMJ, after this merge, the unique validation rule is getting failed for sub-text.

    User::create(['name' => 'John Doe']);
    $validator = Validator::make(
        ['name' => 'John'],
        ['name' => 'required|unique:users']
    );
    $this->assertFalse($validator->fails()); // it fails

Problem is in regex

https://github.com/jenssegers/laravel-mongodb/blob/bc78c7575b879351eedc4a57b5ac0410ee765b51/src/Jenssegers/Mongodb/Validation/DatabasePresenceVerifier.php#L20

Instead, it should be

    $query = $this->table($collection)->where($column, 'regex', '/^'.$value.'$/i'); 

One issue is already opened for the same #1616

mnphpexpert added a commit to mnphpexpert/laravel-mongodb that referenced this pull request Sep 2, 2024
…rifier

[Bug Fix][Validation][Security] Fix working of unique and exists
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants