Page MenuHomePhabricator

Let UsersMultiselectWidget disallow arbitrary input
Open, Needs TriagePublic



Currently allowArbitrary is hardcoded to true, meaning that the widget will accept any input, even if not a real user.

This means you can input any string and press enter, and a tag will be made. If exists is true, there will be an error; otherwise there will be no error. (To see an example of this behaviour, go to Special:Preferences with $wgEnableUserEmailBlacklist = true and enter a nonexistent username. Click Save and the form will submit with no error.)


It should be made possible to set allowArbitrary = false, so that a tag will not be made unless the string entered is valid. This is already possible for both the TitlesMultiselectWidget and the NamespacesMultiselectWidget.


Solving this will involve more than simply allowing the config to be passed. With allowArbitrary = false, the tag is not made when a menu item is selected. From a cursory look into this, it appears that when the menu item is selected, the input value is cleared, so the menu items are never added. (Filed as T243075.)


Related Gerrit Patches:

Event Timeline

Tchanders moved this task from Untriaged to Cards ready to be discussed on the Anti-Harassment board.

Change 565618 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/core@master] Stop forcing UsersMultiselectWidget to accept arbitrary input

Tchanders renamed this task from Update UsersMultiselectWidget to disallow arbitrary input to Let UsersMultiselectWidget disallow arbitrary input.Fri, Jan 17, 4:09 PM
Tchanders updated the task description. (Show Details)

@Mooeypoo - Have tested the UsersMultiselectWidget and the TitlesMultiselectWidget with throttling, and they both behave the same:

  1. Turn on throttling
  2. Type a valid entry quickly, then press enter
  3. The widget shows a pending element until the menu appears, then does nothing
  4. At that point the user can press enter again and a tag is added

(For the UsersMultiselectWidget, step 4 doesn't work until T243075 is solved, with or without throttling.)