Bug #85938 MySQLMembershipProvider.FindUsersByEmail with null email returns all users
Submitted: 13 Apr 2017 19:38 Modified: 31 May 2018 11:54
Reporter: Matt Houser Email Updates:
Status: Verified Impact on me:
Category:Connector / NET Severity:S3 (Non-critical)
Version:6.9.9 OS:Any
Assigned to: CPU Architecture:Any
Tags: MySqlMembershipProvider

[13 Apr 2017 19:38] Matt Houser
When using the MySQLMembershipProvider, if you do:

var c = Membership.FindUsersByEmail(null);

Then c will contain a collection of ALL users.

How to repeat:
1. Setup your .NET Membership Provider using the MySQLMembershipProvider.
2. Add a few users, giving all users a unique email address.
3. Execute the following code:

var c = Membership.FindUsersByEmail(null);

4. Inspect c.

Suggested fix:
One of 2 solutions:

1. Check for null or empty within MySQLMembershipProvider.FindUsersByEmail() for null or empty email and throw an exception.


2. Actually return a list of users where email is null or empty.
[31 May 2018 11:54] Chiranjeevi Battula
Hello Matt Houser,

Thank you for the bug report.
Verified based on internal discussion with dev's.