Page MenuHomePhabricator

Let UsersMultiselectWidget disallow arbitrary input
Closed, ResolvedPublic

Description

Problem

Currently allowArbitrary is hardcoded to true, meaning that the widget will accept any input, even if not a real user.

This means you can input any string and press enter, and a tag will be made. If exists is true, there will be an error; otherwise there will be no error. (To see an example of this behaviour, go to Special:Preferences with $wgEnableUserEmailBlacklist = true and enter a nonexistent username. Click Save and the form will submit with no error.)

Proposal

It should be made possible to set allowArbitrary = false, so that a tag will not be made unless the string entered is valid. This is already possible for both the TitlesMultiselectWidget and the NamespacesMultiselectWidget.

Notes

Solving this will involve more than simply allowing the config to be passed. With allowArbitrary = false, the tag is not made when a menu item is selected. From a cursory look into this, it appears that when the menu item is selected, the input value is cleared, so the menu items are never added. (Filed as T243075.)

Details

Related Gerrit Patches:

Related Objects

Event Timeline

Tchanders moved this task from Untriaged to Cards ready to be discussed on the Anti-Harassment board.

Change 565618 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/core@master] Stop forcing UsersMultiselectWidget to accept arbitrary input

https://gerrit.wikimedia.org/r/565618

Tchanders renamed this task from Update UsersMultiselectWidget to disallow arbitrary input to Let UsersMultiselectWidget disallow arbitrary input.Jan 17 2020, 4:09 PM
Tchanders updated the task description. (Show Details)

@Mooeypoo - Have tested the UsersMultiselectWidget and the TitlesMultiselectWidget with throttling, and they both behave the same:

  1. Turn on throttling
  2. Type a valid entry quickly, then press enter
  3. The widget shows a pending element until the menu appears, then does nothing
  4. At that point the user can press enter again and a tag is added

(For the UsersMultiselectWidget, step 4 doesn't work until T243075 is solved, with or without throttling.)

Change 565618 merged by jenkins-bot:
[mediawiki/core@master] Stop forcing UsersMultiselectWidget to accept arbitrary input

https://gerrit.wikimedia.org/r/565618

dom_walden added a subscriber: dom_walden.

I can no longer add a tag, unless it is of a valid user.

Tested the email-blacklist on Special:Preferences on https://en.wikipedia.beta.wmflabs.org (1.35.0-alpha (874395c) 06:53, 4 February 2020).

EDIT: It should also be noted that invalid input gets cleared when removing/moving previous tags. Before, it would add a (invalid) tag. This might be an improvement.

For example, before:


After removing "QWERTYNAPOLI", "jksdlfj" is cleared:

Tchanders closed this task as Resolved.Feb 4 2020, 7:30 PM