Parent skin names are case insensitive, potentially leading to users having access to others' skins

Description

What should happen:
When a user saves a skin after having added a parent skin, the skin assigned as the parent skin should belong to the user (or be public) and should match the case of what the user entered.

What happens instead:
When a user enters the name of a skin to be used as a parent skin, regardless of what capitalization they use, when the save the child skin the parent skin actually assigned will be whatever skin was first created with that name disregarding capitalization/cases. This will happen even if that skin does not belong to the user who is trying to add a parent skin.

To replicate:

1) make a site skin with a unique name using one account
2) switch to a different account
3) make another site skin with the same name, but different cases/capitalization
3) make a third skin and try to add the second skin as its parent

The child skin will have the first skin listed as a parent skin instead of the second skin, and if you use that child skin and inspect what css is being applied, you will see the css from the first skin being applied but not any from the second skin.

Assignee

Unassigned

Reporter

GoldenFalls

Roadmap

Skins

Priority

Medium

Affects versions

Fix versions

None

Components

BackEnd

Difficulty

Medium

Milestone

Internal 0.9
Configure