If I remember well, that happened to me, but your step 3 is incorrect:

"
3. he edited his profile, but he did NOT change his username or want to change his username."

When your friend edited his profile his username was truncated to 10 (but he probably did not noticed)
So he did acepted the changes made to username when he hit the submit button.

I do not know if this logic is correct. I would prefer that the system kept the current username in the form and did not force the user to change to a shorter username.

well first, i would be glad to hear GPBoarder inputs, instead of yeppers ones.
Then :

Quote:
no comment. let's wait for GPBoarder inputs, would be more constructive.

Quote:
The only way to create an account named "Administrator" it to, before to create this account, set the max lenght to more than 10. So then you change back to 10. let's confirm !
how did you create that account? from what area?

Quote:
wrong, he did not say that.

Quote:
well, trabis explanation could be the right one. but let's wait for GPB answer.

Quote:

that is pretty clear english to me. he was making changes to the birthday field, not the username. i am not wrong.

but lets wait for gpboarder.

Quote:Well, this is a tricky one.
There is a rule for the length of names. If you change the rule by increasing the maximum length, there is no problem. If you decrease it, then there migth be some names that violate the new rule for the length.

What has do be done next?

Checking every existing name and eg prevent that the maximum goes beneath the longest is not so very practical, because the next question is then which names are preventing us from lowering the size? Do we then do an override and truncate every name, which lock a lot of users out because the changed names? Or do we insist that the long ones are edited one by one to fit in the target length?

We could also simply accept the new lower setting and do nothing. But when such a user profile is edited the new rule should be enforced.
It could be by bluntly truncating it, but this leads to the TS problem.

I think the user should get an error message that his name is too long to fit, when he tries to save his edited profile. He can then knowingly adapt his name to the length required.

In no way the system should silently present the name truncated. It should always show what was accepted the last time and is in the database.

This length should not be checked or enforced in the login dialog!

It is only for creating an account or when editing the profile. I assume the length checking is done in PHP and is not relying on the html input attributes alone, because that is not secure and can be easy circumvented!

Wow. I post something, go away for a couple of days and look at this. My Inbox overfloweth.

So. It was a new installation. When prompted for the administrator name during the installation, I used Administrator.

Later I was fooling around with the field in the user profile that I wanted members to be able to use as their birthday. That is where I encountered the calendar problem. I don't know if that is possibly related.

It was when I was doing those updates to the profile that I noticed the change from Administrator to Administra in a block on the page.

Sure enough, I couldn't login any longer with Administrator, but Administra worked just fine.

I'm far from a pro, but I didn't edit the Administrator username inadvertently. The system did it somehow.

In editing it now, I find that I can change it to Administrator by means of the System Edit User menu, but cannot by means of the User Profile Module. User Profile Module only wants 10 characters.

Using the System>Edit User, I changed it back to Administrator.

Under the Profile Module and choosing to edit Administrator, it brings up Administrator in the field, but if I delete the "tor", I cannot type it back in.

It's late on my side of the pond so I'm not going to give any perspectives on the U.S. tonight.

Incidentally, this thread is a good example of why I think we need an "exclude from search" ability. Then the member or the moderator could check that little box and searches would only yield the first post containing the problem and whatever posts actually contain the answer.

It might be fun to read through this today, but I guarantee when this happens to someone else, the volume of posts in this thread will not really be of assistance.

As a basic user, I think if there is going to be a limit on the username length, that control should be in place during the installation process.

thanks for those inputs, more constructive, but i need more details to be able to fix the issue
- First it should be impossible to enter Administrator by default settings, since 10 is set. it is actually not possible through Ext profile registration. We have to test without Ext Profile with classic registration, and from admin and user edit (with/without ext profile). I will try to find some time tonight to test.
- Second, we have to deal with the modification of the setting and preexistant accounts, and/or to find in what cases it occurs (module update, profile edition,etc..)

Quote:It seems he has set the name during the install with the initial setup of XOOPS. Probably, there is another length that applies and allow 'Administrator' in full.

Should we restrict the length there also to 10?
I don't think so. It would be better to save the longer length of the choosen administrator name as default maximum length. (Or 10 when the name was shorter.)

@GPboarder
PS If 'Administrator' is your administrator name to login, you might change it now for security reasons.

Just a thought....

Has this happened on site that was upgraded from 2.0.18.x?

It may have been that udernames longer than 10 were formerly allowed. I have several usernames longer than 10 character on my site.

Quote:
Quote:
Quote:For upgrades the previous setting should be retained.