Page MenuHomePhabricator

Let UsersMultiselectWidget disallow arbitrary input
Closed, ResolvedPublic



Currently allowArbitrary is hardcoded to true, meaning that the widget will accept any input, even if not a real user.

This means you can input any string and press enter, and a tag will be made. If exists is true, there will be an error; otherwise there will be no error. (To see an example of this behaviour, go to Special:Preferences with $wgEnableUserEmailBlacklist = true and enter a nonexistent username. Click Save and the form will submit with no error.)


It should be made possible to set allowArbitrary = false, so that a tag will not be made unless the string entered is valid. This is already possible for both the TitlesMultiselectWidget and the NamespacesMultiselectWidget.


Solving this will involve more than simply allowing the config to be passed. With allowArbitrary = false, the tag is not made when a menu item is selected. From a cursory look into this, it appears that when the menu item is selected, the input value is cleared, so the menu items are never added. (Filed as T243075.)

Related Objects

Event Timeline

Change 565618 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/core@master] Stop forcing UsersMultiselectWidget to accept arbitrary input

Tchanders renamed this task from Update UsersMultiselectWidget to disallow arbitrary input to Let UsersMultiselectWidget disallow arbitrary input.Jan 17 2020, 4:09 PM
Tchanders updated the task description. (Show Details)

@Mooeypoo - Have tested the UsersMultiselectWidget and the TitlesMultiselectWidget with throttling, and they both behave the same:

  1. Turn on throttling
  2. Type a valid entry quickly, then press enter
  3. The widget shows a pending element until the menu appears, then does nothing
  4. At that point the user can press enter again and a tag is added

(For the UsersMultiselectWidget, step 4 doesn't work until T243075 is solved, with or without throttling.)

Change 565618 merged by jenkins-bot:
[mediawiki/core@master] Stop forcing UsersMultiselectWidget to accept arbitrary input

dom_walden subscribed.

I can no longer add a tag, unless it is of a valid user.

Tested the email-blacklist on Special:Preferences on (1.35.0-alpha (874395c) 06:53, 4 February 2020).

EDIT: It should also be noted that invalid input gets cleared when removing/moving previous tags. Before, it would add a (invalid) tag. This might be an improvement.

For example, before:

usermultibefore.png (60×717 px, 6 KB)

After removing "QWERTYNAPOLI", "jksdlfj" is cleared:
usermultiafter.png (60×709 px, 6 KB)