Page MenuHomePhabricator

Username validation message does not describe failure reason, only "You have not specified a valid username"
Closed, ResolvedPublic

Description

Author: rohrmanj

Description:
URL: http://toro.wmflabs.org/w/index.php?title=Special:UserLogin&action=submitlogin&type=signup

Description:
Error messages for user name do not adequately describe the reason for the failure. This could make it difficult to know what to fix.

Example:
1 - Enter the following user name: !@#$%^&*()_+-={}[]|\:";'<>?,./
2 - populate other required fields
3 - click Create Account button

note:
User receives the following validation message

Login error
You have not specified a valid username.

note:
there is no description of why the username is not valid.


Version: 1.22.0
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=38303
https://bugzilla.wikimedia.org/show_bug.cgi?id=34447

Details

Reference
bz46995

Related Objects

View Standalone Graph
This task is connected to more than 200 other tasks. Only direct parents and subtasks are shown here. Use View Standalone Graph to show more of the graph.

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:20 AM
bzimport set Reference to bz46995.

Yes, it's very unfriendly. When extensions such as TitleBlackList and AntiSpoof reject a name they sometimes display a more friendly error, but the core User.php code returns no useful information as to why it rejected a name, so the error message ('noname') is unavoidably vague.

In this case, '#' isn't allowed in page titles, so not allowed in user names. (Remember that every user has a User:<username> page on the wiki, so usernames must be OK as titles.) Next $wgInvalidUsernameCharacters is checked, it defaults to '@', so that's a no-no. Then there's a check for "invalid due to empty, IP, slash, length, or lowercase starting letter". Etc., etc. -- 11 years of accreted ad hoc rules that resist summary. For what it's worth "!$%^&*()_+-=:"?,." is a valid username in a stock MediaWiki install, but the AntiSpoof extension rejects it.

The form links to _Help me choose_ for user guidance, which on enwiki is http://en.wikipedia.org/wiki/Wikipedia:Username_policy . But that doesn't say much about things not to try..

Proper solution for this case is, IMHO, to make the username field AJAXy so that as soon as you enter an invalid character it becomes red (or whatever) and it's obvious what you've done wrong.

However yes, there are several bugs about hardly actionable error messages produced by titleblacklist and friends, see e.g. bug 38303.

Interactive username validation is bug 21416. The "account creation user experience" experiment on enwiki had interactive username validation, but it wasn't ideal because of bug 40648 (can't validate username against blocking extensions like AntiSpoof). The extensions run *during* the creation of a new account, not *before* creating an account.

(In reply to comment #3)

Interactive username validation is bug 21416.

Yes, thanks for linking it. I know it's a different issue, but if fixed completely it would supersede this.

The "account creation user
experience" experiment on enwiki had interactive username validation, but it
wasn't ideal because of bug 40648 (can't validate username against blocking
extensions like AntiSpoof). The extensions run *during* the creation of a new
account, not *before* creating an account.

I that unfixable?

swalling wrote:

(In reply to comment #4)

(In reply to comment #3)

Interactive username validation is bug 21416.

Yes, thanks for linking it. I know it's a different issue, but if fixed
completely it would supersede this.

The "account creation user
experience" experiment on enwiki had interactive username validation, but it
wasn't ideal because of bug 40648 (can't validate username against blocking
extensions like AntiSpoof). The extensions run *during* the creation of a new
account, not *before* creating an account.

I that unfixable?

If there is someone willing to tackle fixing the extensions listed in bug 40648 (TitleBlacklist, AntiSpoof, maybe others), then it's not unfixable.

Adding many blockers of bug 38638 to the list of "easy" bugs, to mark them as candidates for [[mw:Google Code-in]] tasks (gci2013). If you think this bug is not suitable, remove the keyword.

Spage set Security to None.

So, do we need relevant error messages or -- are we going to use AJAX responsiveness ?

Hello I'm all new to MediaWiki development and FOSS projects. And I would like to try work on this bug as my first fix. So, shall I start working on displaying a more informative error message?

Hey @AnuradhaW : You can find how to create a patch here : http://www.mediawiki.org/wiki/Gerrit/Tutorial. Clone mediawiki core and try to get the error reason too printed along with the validation message. You can ask your queries here or in #wikiemdia-dev
Happy hacking !

Thank you very much. I got the mediawiki core cloned and I am working on it.

I'm having a problem here. In the en.json file I tried to change the following 2 lines:

"createacct-error": "Account creation error",
"noname": "You have not specified a valid username.",

to

"createacct-error": "Account creation error Testing",
"noname": "You have not specified a valid username. Testing",

and expected that the current message shown for an invalid username input would change. Yet it did not.

But it worked when I input 2 different passwords for the Password field and Confirm Password field and submitted. Then the error came as :

Account creation error Testing
The passwords you entered do not match.

Is there something I'm missing here?

and expected that the current message shown for an invalid username input would change. Yet it did not.

You will have to clear your browser cache ( or restart your browser ) too see the changes taking effect. I just got the same issue - cleared cache - got the message :)

Hi, I would like to work on resolving this issue if someone is not already working on it. As @Spage mentioned in comment #1 the reasons for the failure of account creation could be the following :-

  1. '#' character in the username.
  2. $wgInvalidUsernameCharacters is checked, which defaults to '@', so usernames should not contain characters that are present in $wgInvalidUsernameCharacters array.
  3. There's a check for "invalid due to empty, IP, slash, length, or lowercase starting letter".
  4. Check if the username is Reserved.
  5. Check for blacklist of troublemaker characters
  6. Check that username is not misresolved as a different title

All these checks are implemented in the Users.php file and invoked by "getCanonicalName" function. I think we'll have to make changes to "User.php" and "mediawiki.special.userlogin.signup.js" file to display appropriate error messages to the user. Please let me know if I have missed any important case and if we need to handle rejection by AntiSpoof extension?