Page MenuHomePhabricator

usprop=cancreate API returns a username can be created on some wikis but not actually
Closed, InvalidPublicBUG REPORT

Description

List of steps to reproduce (step by step, including full links if applicable):
For username "BrionVIBBER"
loginwiki:

{
    "name": "BrionVIBBER",
    "missing": "",
    "cancreateerror": [
        {
            "message": "$1",
            "params": [
                "The username &quot;BrionVIBBER&quot; is too similar to the following usernames:<ul><li>Brion VIBBER</li><li>Brion VIBBEr</li><li>Brion Vibber</li></ul>Please choose another username."
            ],
            "code": "_1",
            "type": "error"
        }
    ]
}

enwiki:

{
    "name": "BrionVIBBER",
    "missing": "",
    "cancreateerror": [
        {
            "message": "$1",
            "params": [
                "The username &quot;BrionVIBBER&quot; is too similar to the following usernames:<ul><li>Brion VIBBER</li><li>Brion VIBBEr</li><li>Brion Vibber</li></ul>Please choose another username."
            ],
            "code": "_1",
            "type": "error"
        }
    ]
}

zhwiki:

{
    "name": "BrionVIBBER",
    "missing": "",
    "cancreate": ""
}

What happens?:
For username "BrionVIBBER", The API says it can be created on zhwiki.

What should have happened instead?:
Since we have unified login, I think it should have the same behavior on different wikis. It should return "cancreateerror" on zhwiki for username "BrionVIBBER".

Event Timeline

Since we have unified login, I think it should have the same behavior on different wikis. It should return "cancreateerror" on zhwiki for username "BrionVIBBER".

It does (by default)

Screen Shot 2022-03-16 at 11.31.47 AM.png (807×1 px, 151 KB)

There's no global account 'BrionVIBBER'; https://meta.wikimedia.org/wiki/Special:CentralAuth?target=BrionVIBBER, and so it is creatable until disallowed by AntiSpoof. But AntiSpoof can be overridden by a user right, and you're allowed to do that on zwhiki, but not on enwiki and loginwiki. That's why you see different result on different wikis.

But AntiSpoof can be overridden by a user right

I didn't notice this. I think it's better to provide a API parameter to decide whether to use user right in checking or to provide more information in API result.

I think it's better to provide a API parameter to decide whether to use user right in checking or to provide more information in API result.

You can create new task to request that. But, in my view, it does not look useful. It you want your user-rights to not affect what results is returned to you, you should either log out, use fresh account or use incognito browser profile. In all other cases where you're logged-in, user-rights will influence what you see and can access.