Page MenuHomePhabricator

Email confirmation status on Special:MergeAccount
Closed, ResolvedPublic


Author: gangleri


Today « special:MergeAccount » shows only « password » or « mail » .

There are no informations if the email was ever confirmed or not.

I hope that the further functionality will not require to show such « minor details » (for example if the email is confirmed or not or informations about what should happen with the email : allow emails from other users etc.).

However it makes a great difference if the email is confirmed or not, if it is enabeled etc.

Best regards Reinhardt [[user:Gangleri]]

see bug 012091 · tracking bug for issues related to « Single login » · « Unified login »

Version: unspecified
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:01 PM
bzimport set Reference to bz12098.
bzimport added a subscriber: Unknown Object (MLST).

rotemliss wrote:

This would be a bit difficult, as what currently shown is only the merging reason info, stored in the database. Nevertheless, you can't choose not to merge accounts that can be merged automatically.

I would support automatically merging only accounts that have their e-mail address confirmed, to avoid possible merges with malicious users. CentralAuth should ensure all the contributions from the merged accounts are done by the same person, and merging users with unconfirmed e-mail address breaks this, and may make the sysops think he is the same user, which may be a vandal, or even blocked indefinitely (and now his new account will be useless). (You may say merging empty users breaks this too, but fortunately, empty users made no contributions, and may be blocked only for name, which is shared anyway.)

rotemliss wrote:

E-mail is mentioned and used for migration only if confirmed as of r32091.