Author: thomas.dalton

Description:
This is just based of my reading of the code, I haven't actually tested it, so I may be completely wrong. However, looking at chooseHomeWiki() in CentralAuthUser.php, it seems that if there are multiple local accounts with the same name, only one of which is privileged, and that privileged account is blocked (or multiple privileged accounts, all of which are blocked), no account will "win". I think privileged accounts ought to have their block status checked before the

if( !$workingSet ) {

    // No privileged accounts; look among the plebes...
    $workingSet = $migrationSet;
}

bit.

Version: unspecified
Severity: normal