FIX: allows to query a username made of integers (#25815)

If a user had `123456789` as username, it could be passed to the query as a number and the query would fail as it expects a string.

Also applies the same fix to groups.
This commit is contained in:
Joffrey JAFFEUX 2024-02-22 14:53:47 +01:00 committed by GitHub
parent 5ea1882e17
commit 84cd621bdc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 2 deletions

View File

@ -9,8 +9,8 @@ module Chat
.where(user_options: { chat_enabled: true })
.where(
"username IN (?) OR (groups.name IN (?) AND group_users.user_id IS NOT NULL)",
usernames,
groups,
usernames&.map(&:to_s),
groups&.map(&:to_s),
)
.where.not(id: excluded_user_ids)
.distinct

View File

@ -15,6 +15,12 @@ describe Chat::UsersFromUsernamesAndGroupsQuery do
result = described_class.call(usernames: [user1.username, user4.username], groups: [])
expect(result).to contain_exactly(user1, user4)
end
it "works with a number" do
user = Fabricate(:user, username: 12_345_678)
result = described_class.call(usernames: [12_345_678], groups: [])
expect(result).to contain_exactly(user)
end
end
context "when searching by groups" do
@ -22,6 +28,12 @@ describe Chat::UsersFromUsernamesAndGroupsQuery do
result = described_class.call(usernames: [], groups: [group1.name])
expect(result).to contain_exactly(user1, user2)
end
it "works with a number" do
group = Fabricate(:public_group, users: [user1, user2], name: 12_345_678)
result = described_class.call(usernames: [], groups: [12_345_678])
expect(result).to contain_exactly(user1, user2)
end
end
context "when searching by both usernames and groups" do