Because users login with mixed casing and whatnot.
function checkPassword($username, $password)
{
+ $username = Nickname::normalize($username);
+
$user = User::getKV('nickname', $username);
if (!($user instanceof User)) {
return false;
// $oldpassword is already verified when calling this function... shouldn't this be private?!
function changePassword($username, $oldpassword, $newpassword)
{
+ $username = Nickname::normalize($username);
+
if (!$this->password_changeable) {
return false;
}