Page MenuHomePhabricator

🐛 Bug | Email is not properly validated, resulting in empty page
Closed, ResolvedPublic

Description

Steps to reproduce:

Fill with in donation form with email address teste®@example.com and push submit

Expected Result:
Email address is shown as invalid

Actual result:
Form is submitted, but validation fails and user sees an empty page.

Notice: Search the application log for Unexpected server-side form validation errors to get ideas for other invalid email addresses.

It seems like the "source" field for the email ConstraintViolation is not set, because the error message Unexpected server-side form validation errors in the application log does not contain the field name and the PHP error log contains notices: PHP Notice: Undefined index: in /usr/share/nginx/www/spenden.wikimedia.de/release-20191111172411/src/Presentation/Presenters/DonationFormViolationPresenter.php on line 146. But this is a side-effect, not the root rause of the underlying error. Please fix it if possible.

Event Timeline

gabriel-wmde renamed this task from Email is not properly validated, resulting in empty page to 🐛 Email is not properly validated, resulting in empty page.Nov 11 2019, 5:43 PM
chrp renamed this task from 🐛 Email is not properly validated, resulting in empty page to 🐛 Bug | Email is not properly validated, resulting in empty page.Nov 12 2019, 9:04 AM

While investigating, we found two bugs:

  1. Laika does not send emails to the validate-email route when submitting an address. This allows for the observed behavior of being able to submit an invalid email to donation/add.
  2. Our homegrown EmailAddress and EmailValidator classes are too strict. We disallow multiple '@' signs (which could be quoted to become a valid email address) and don't check emails with the [[ https://www.php.net/manual/en/filter.filters.flags.php | FILTER_FLAG_EMAIL_UNICODE ]] flag to allow for unicode characters in the local part.
kai.nissen claimed this task.