Bug #85938 MySQLMembershipProvider.FindUsersByEmail with null email returns all users

• Submitted: 13 Apr 2017 19:38
• Modified: 31 May 2018 11:54
• Reporter: Matt Houser
• Status: Verified
• Category: Connector / NET
• Severity: S3 (Non-critical)
• Version: 6.9.9
• OS: Any
• CPU Architecture: Any
• Tags: MySqlMembershipProvider

[13 Apr 2017 19:38] Matt Houser

Description:
When using the MySQLMembershipProvider, if you do:

var c = Membership.FindUsersByEmail(null);

Then c will contain a collection of ALL users.

How to repeat:
1. Setup your .NET Membership Provider using the MySQLMembershipProvider.
2. Add a few users, giving all users a unique email address.
3. Execute the following code:

var c = Membership.FindUsersByEmail(null);

4. Inspect c.

Suggested fix:
One of 2 solutions:

1. Check for null or empty within MySQLMembershipProvider.FindUsersByEmail() for null or empty email and throw an exception.

OR

2. Actually return a list of users where email is null or empty.

[31 May 2018 11:54] Chiranjeevi Battula

Hello Matt Houser,

Thank you for the bug report.
Verified based on internal discussion with dev's.

Thanks,
Chiranjeevi.