Page MenuHomePhabricator

UserManagement: Anonymous Account not create-/delete-/edit able , but it is visbile in user list
Closed, ResolvedPublic


Author: sacher

There is this user account "User:Anonymous" in the list of users after installation?
Which functionality does this user account have?

Both renaming users name and viewing settings was not possible.
I would not like to have an account there that is a sort of backdoor.

Steps to reproduce:

  • Showing all users, the user:Anonymous appears.
  • Visiting the user's page there is no link for user contributions.
  • Renaming this user says: Der Benutzername „“ ist ungültig.
  • Changing rights is not possible because it is said the user did not exist.
  • Creating a new accout with this name causes an

"Error: Warning: pg_query() []: Query failed: ERROR: duplicate key violates unique constraint "mwuser_user_name_key" in /var/www/ on line 552"

Please see detailed debugging information below.

Thanx in advance. Cheers


MediaWiki 1.13.2
PHP 5.2.0-8+etch13 (apache2handler)
PostgreSQL PostgreSQL 8.1.13 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.1.2 20061115 (Debian 4.1.1-21)
Plugins: EditUser (Version 1.5.1) , Renameuser (Version r41963)

Error Message:

A database error has occurred Query: INSERT INTO mwuser (user_id,user_name,user_password,user_newpassword,user_newpass_time,user_email, user_email_authenticated,user_real_name,user_options, user_token,user_registration,user_editcount) VALUES ('9','Anonymous',,,'2008-11-28 13:08:53 GMT',,NULL,,'quickbar=1 underline=2 cols=80 rows=25 searchlimit=20 contextlines=5 contextchars=50 disablesuggest=0 ajaxsearch=0 skin= math=1 usenewrc=0 rcdays=7 rclimit=50 wllimit=250 hideminor=0 highlightbroken=1 stubthreshold=0 previewontop=1 previewonfirst=0 editsection=1 editsectiononrightclick=0 editondblclick=0 editwidth=0 showtoc=1 showtoolbar=1 minordefault=0 date=default imagesize=2 thumbsize=2 rememberpassword=0 enotifwatchlistpages=0 enotifusertalkpages=1 enotifminoredits=0 enotifrevealaddr=0 shownumberswatching=1 fancysig=0 externaleditor=0 externaldiff=0 showjumplinks=1 numberheadings=0 uselivepreview=0 watchlistdays=3 extendwatchlist=0 watchlisthideminor=0 watchlisthidebots=0 watchlisthideown=0 watchcreations=0 watchdefault=0 watchmoves=0 watchdeletion=0 variant=de language=de searchNs0=1','b1821d58eed30ceb814a1cdfbaf13ecc','2008-11-28 13:08:53 GMT','0') Function: User::addToDatabase Error: 1 ERROR: duplicate key violates unique constraint "mwuser_user_name_key"


    1. 0 /var/www/wiki/includes/db/Database.php(561): DatabasePostgres->reportQueryError('ERROR: duplica...', 1, 'INSERT INTO mwu...', 'User::addToData...', )
    2. 1 /var/www/wiki/includes/db/DatabasePostgres.php(817): Database->query('INSERT INTO mwu...', 'User::addToData...', )
    3. 2 /var/www/wiki/includes/User.php(2271): DatabasePostgres->insert('user', Array, 'User::addToData...')
    4. 3 /var/www/wiki/includes/specials/SpecialUserlogin.php(339): User->addToDatabase()
    5. 4 /var/www/wiki/includes/specials/SpecialUserlogin.php(324): LoginForm->initUser(Object(User), false)
    6. 5 /var/www/wiki/includes/specials/SpecialUserlogin.php(153): LoginForm->addNewAccountInternal()
    7. 6 /var/www/wiki/includes/specials/SpecialUserlogin.php(96): LoginForm->addNewAccount()
    8. 7 /var/www/wiki/includes/specials/SpecialUserlogin.php(17): LoginForm->execute()
    9. 8 [internal function]: wfSpecialUserlogin(NULL, Object(SpecialPage))
  1. 9 /var/www/wiki/includes/SpecialPage.php(748): call_user_func('wfSpecialUserlo...', NULL, Object(SpecialPage))
  2. 10 /var/www/wiki/includes/SpecialPage.php(534): SpecialPage->execute(NULL)
  3. 11 /var/www/ SpecialPage::executePath(Object(Title))
  4. 12 /var/www/ MediaWiki->initializeSpecialCases(Object(Title), Object(OutputPage), Object(WebRequest))
  5. 13 /var/www/ MediaWiki->initialize(Object(Title), NULL, Object(OutputPage), Object(User), Object(WebRequest))
  6. 14 {main}</nowiki>

Version: 1.13.x
Severity: major



Related Objects

View Standalone Graph
This task is connected to more than 200 other tasks. Only direct parents and subtasks are shown here. Use View Standalone Graph to show more of the graph.

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:24 PM
bzimport set Reference to bz16487.
bzimport added a subscriber: Unknown Object (MLST).

sacher wrote:

Please Note: Path to wiki is allways the same, I just faild at renaming the path in this bug report.

sacher wrote:

In other words: I cannot delete the user because he does not exist. I cannot create the user because he exists. And he is shown in the user list. So, what is wrong? Is it a bug in this Version?

It's a nasty hack implemented in order to make foreign key constraints work in a schema that wasn't designed for them.

  • Create a dummy user to satisfy fk contraints especially with revisions



I would suggest removing the foreign key constraints from the PG schema, which are more trouble than they're worth.

karun.84 wrote:

I would like to propose that we hide the User:Anonymous user from the user list.

karun.84 wrote:

Patch that hides User:Anonymous on the user list.

I have created a patch that hides User:Anonymous from the user list. Im not sure if this would be the best way to resolve this bug.


karun.84 wrote:

Are there any backdoors that could result from the Anonymous user being in the database? I think if they are able to do something to the anonymous user in the database through a backdoor, then it will probably just affect all users rather than just one.

Review of the patch: it doesn't take into account that there are different DB backends, most of which doesn't create that dummy account. Therefore, someone could register a stealth account 'Anonymous' that will be hard to track. And using a hardcoded value for checks is also extremely problematic.

karun.84 wrote:

(In reply to comment #7)

Review of the patch: it doesn't take into account that there are different DB
backends, most of which doesn't create that dummy account. Therefore, someone
could register a stealth account 'Anonymous' that will be hard to track. And
using a hardcoded value for checks is also extremely problematic.

Would checking the database, be suitable so if postgresql is used then the anonymous account is hidden from the user list?

Jdforrester-WMF subscribed.

Migrating from the old tracking task to a tag for PostgreSQL-related tasks.

Change 404167 had a related patch set uploaded (by Seb35; owner: Seb35):
[mediawiki/extensions/ApprovedRevs@master] Error when displaying a blank page

Seb35 subscribed.

Submitted a patch with the wrong task, I fixed it but I remove the references added here.