Session: Enable session duplication with session-specific content - refs BT#22254#7440
Merged
Merged
Conversation
AngelFQC
added a commit
that referenced
this pull request
Jun 17, 2026
The user-selection query mixed AND and OR without parentheses, so SQL
precedence made the active <> USER_SOFT_DELETED filter apply only to the
first LIKE clause; the trailing OR clause matched users regardless of
status, exposing soft-deleted accounts in the admin assignment list.
The OR was a redundant leftover: it originally matched the first letter in
both original and lowercased case ('A%' OR 'a%'), but a 2015 SQLi-hardening
change (refs #7440) replaced both sides with the same escaped lowercase
value, leaving two identical conditions. With Chamilo's case-insensitive
collation a single lowercase LIKE already matches both cases, so collapse
the OR to one LIKE. This both removes the dead condition and eliminates the
precedence ambiguity, keeping the active-status filter always applied.
Refs GHSA-6cmq-j35w-q932
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
AngelFQC
added a commit
that referenced
this pull request
Jun 17, 2026
The user-selection query in access_url_add_users_to_url.php mixed AND and OR
without parentheses, so SQL precedence made the active <> USER_SOFT_DELETED
filter apply only to the first LIKE clause; the trailing OR clause matched
users regardless of status, listing soft-deleted accounts in the admin
assignment UI.
The OR was a redundant leftover: it originally matched the first letter in
both original and lowercased case ('A%' OR 'a%'), but a 2015 change (refs
#7440) replaced both sides with the same escaped lowercase value, leaving
two identical conditions. With Chamilo's case-insensitive collation a single
lowercase LIKE already matches both cases, so collapse the OR to one LIKE.
This removes the dead condition and the precedence ambiguity, keeping the
active-status filter always applied.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
AngelFQC
added a commit
that referenced
this pull request
Jun 17, 2026
The user-selection query in access_url_add_users_to_url.php mixed AND and OR
without parentheses, so SQL precedence made the active <> USER_SOFT_DELETED
filter apply only to the first LIKE clause; the trailing OR clause matched
users regardless of status, listing soft-deleted accounts in the admin
assignment UI.
The OR was a redundant leftover: it originally matched the first letter in
both original and lowercased case ('A%' OR 'a%'), but a 2015 change (refs
#7440) replaced both sides with the same escaped lowercase value, leaving
two identical conditions. With Chamilo's case-insensitive collation a single
lowercase LIKE already matches both cases, so collapse the OR to one LIKE.
This removes the dead condition and the precedence ambiguity, keeping the
active-status filter always applied.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ilyassbennanii
pushed a commit
to Ilyassbennanii/chamilo-lms
that referenced
this pull request
Jun 23, 2026
The user-selection query in access_url_add_users_to_url.php mixed AND and OR
without parentheses, so SQL precedence made the active <> USER_SOFT_DELETED
filter apply only to the first LIKE clause; the trailing OR clause matched
users regardless of status, listing soft-deleted accounts in the admin
assignment UI.
The OR was a redundant leftover: it originally matched the first letter in
both original and lowercased case ('A%' OR 'a%'), but a 2015 change (refs
chamilo#7440) replaced both sides with the same escaped lowercase value, leaving
two identical conditions. With Chamilo's case-insensitive collation a single
lowercase LIKE already matches both cases, so collapse the OR to one LIKE.
This removes the dead condition and the precedence ambiguity, keeping the
active-status filter always applied.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.