MobileFrontend: Trying to create a username with a hash in should present the user with an error
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	• Deskana
	May 6 2014, 5:43 PM

Description

If you try to create a username that has a hash in, we've got three totally different behaviours on four platforms:

Desktop: Refuses to create username because it has a hash in it.
iOS App: Lets you create the username, but silently truncates everything including and after the hash, then fails to log you in saying that you provided an illegal username because it tried to log you in to the username that has a hash in.
Android App and Mobile Web: Lets your create the username, but silently truncates everything including and after the hash, then logs you in successfully to the truncated username.

If desktop doesn't let you create these usernames then neither should any of our mobile platforms.

I'm unclear what the correct engineering solution is though. Do we change the API used to create accounts to error if you try to include hashes (instead of silently truncating and creating), or do we just include client-side validation to disallow hashes?

Version: unspecified
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=64409
https://bugzilla.wikimedia.org/show_bug.cgi?id=64960

Details

Reference: bz64959

Event Timeline

• bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 3:21 AM

• bzimport added a project: MobileFrontend-General-or-Unknown.

• bzimport set Reference to bz64959.

• bzimport added a subscriber: Unknown Object (MLST).

• Deskana created this task.May 6 2014, 5:43 PM

bingle-admin wrote:

Prioritization and scheduling of this bug is tracked on Trello card https://trello.com/c/6hlPB67n

On desktop an error (or better to say, warning :p as it's ignorable) is shown to users with JavaScript enabled only, and you can ignore the error and go on to create the account, and the rest is the same as Android.

Disable JavaScript on desktop - you'll get yet another scenario.

Kill the problem at the root - in core. Mobile Web doesn't use the API to create an account - it just submits a username the same way as core but doesn't use JavaScript to check it. If we don't want to allow silent truncation the creation of a username shouldn't truncate and instead throw an error.

I would suggest moving this to a core bug that doesn't allow the creation of usernames with invalid characters. This will force consistency across all platforms.

(In reply to Liangent from comment #2)

On desktop an error (or better to say, warning :p as it's ignorable) is
shown to users with JavaScript enabled only, and you can ignore the error
and go on to create the account, and the rest is the same as Android.

Good point! When I saw the big red message that had the exact same format as the errors, I assumed it was an error. The whole point is probably to trick people into thinking it's an error and not trying to create an account, so I don't feel so bad about it. ;-)

Bug filed in Core for this: bug 64960.

It now displays the error "You have not specified a valid username."

still not fixed? 20140510 version on live enwiki

Works fine for me on master. On desktop and mobile like Kaldari I see

I see this locally and on beta labs.
It looks like the wonderful Bartosz might have fixed this in I88c479cea2bc9d2eab882e0ee8ebcbe2d1dd125e

(In reply to Jon from comment #8)

Works fine for me on master. On desktop and mobile like Kaldari I see

I see this locally and on beta labs.
It looks like the wonderful Bartosz might have fixed this in
I88c479cea2bc9d2eab882e0ee8ebcbe2d1dd125e

btw. how can I configure the app to use beta labs then? Better to have a hidden preference but Yuvi doesn't like it.

MobileFrontend: Trying to create a username with a hash in should present the user with an errorClosed, ResolvedPublicActions

Description

Details

Event Timeline

MobileFrontend: Trying to create a username with a hash in should present the user with an error
Closed, ResolvedPublic
Actions