MOODLE 2.7 failing validation for mixed case usernames via web services

MOODLE 2.7 failing validation for mixed case usernames via web services

by Nathan Mcilree -
Number of replies: 1

2.7.4 (Build: 20150112)

I am trying to create a user via MOODLE web services. This works fine when I send through simple usernames - however when I send a mixed case one such as John.Bennatt@northbrook.gov.uk is fails.

I have set MOODLE to accept complex passwords but still this fails returning this message.

invalid_parameter_exception","errorcode":"invalidparameter","message":"Invalid parameter value detected","debuginfo":"users => Invalid parameter value detected: username => Invalid parameter value detected: Invalid external api parameter: . . . . the server was expecting \\"username\\" type"

I looked in the code and see that in lib/moodlelib.php the validate_param function calls clean_param() - in this (see snippet below) the username is converted to lower case.

$param = core_text::strtolower($param); 

This means that validation fails when the cleaned param (the username) is returned to the validate_params function (code below) as they no longer match.

else if ((string)$param !== (string)$cleaned) {

Sorry if this is in the wrong forum, but am I missing something here as it seems like it will never pass?


Average of ratings: -
In reply to Nathan Mcilree

Re: MOODLE 2.7 failing validation for mixed case usernames via web services

by Yair Spielmann -

Hi Nathan,

I'd say it does so for a good reason - usernames must be in lowercase (this prevents collision issues). When you try to register manually with a mixed case username, you'll be told. I agree that the web service exception you get isn't informative enough.

Checking the extendedusernamechars setting won't change this (its description is a bit confusing, as it seems to imply otherwise, but as you could see in clean_param() the check is made regardless).

So if for some reason you're unable to convert the usernames to lowercase before invoking the webservice, the only solution would be a quite extensive core change, with security and sync risks. See discussion on the referenced ticket https://tracker.moodle.org/browse/MDL-16919

Average of ratings: Useful (1)