Page MenuHomePhabricator

Reject registration creation/edit if the timezone offset is < -12 or > 14
Closed, ResolvedPublic

Description

This is the same bug that affected Special:Preferences (T320296): if the user enters an offset < -12 or > 14, we will silently clamp it to that interval without informing the user. Instead, we should verify if UserTimeCorrection::isValid and show an error if invalid. Note that this only affects the special pages; offsets outside that interval can be specified via the API, as long as PHP accepts them (so up to 99 hours).

Event Timeline

Restricted Application added a subscriber: Aklapper. ยท View Herald TranscriptOct 9 2022, 9:16 PM
Aklapper renamed this task from Reject registratin creation/edit if the timezone offset is invalid to Reject registration creation/edit if the timezone offset is invalid.Oct 10 2022, 10:58 AM
Daimona renamed this task from Reject registration creation/edit if the timezone offset is invalid to Reject registration creation/edit if the timezone offset is < -12 or > 14.Oct 20 2022, 12:51 PM

@Daimona why are offsets > +14 and < +99 converted to +14 in the UI form, but not the API, and < -12 and > -99 are converted to -12 in the form, but not in the API? Should this inconsistency be addressed in this ticket as well?

@Daimona why are offsets > +14 and < +99 converted to +14 in the UI form, but not the API, and < -12 and > -99 are converted to -12 in the form, but not in the API? Should this inconsistency be addressed in this ticket as well?

Because the form has some builtin validation that uses MW utilities that clamp the offset, whereas the API skips that validation and does not change the offset. And yes, this will be addressed in this ticket.

@Daimona why are offsets > +14 and < +99 converted to +14 in the UI form, but not the API, and < -12 and > -99 are converted to -12 in the form, but not in the API? Should this inconsistency be addressed in this ticket as well?

Because the form has some builtin validation that uses MW utilities that clamp the offset, whereas the API skips that validation and does not change the offset. And yes, this will be addressed in this ticket.

ahh thx for the explanation! ๐Ÿ‘

@vaughnwalters This should be fixed now thanks to r881381 for T320296. More generally, the form should now reject all invalid values (like "Foobar" or "+SomethingInvalid") that were previously accepted (but silently changed to +00:00 upon submission). I think at this point it may also be worth re-testing both the special page and the API, to ensure that invalid input is always rejected. Notable examples of invalid input (some of which used to be accepted) are:

  • Plain gibberish (e.g., "foobar")
  • Strings starting with a + sign ("+foobar")
  • Offsets whose value in minutes exceeds 60*100, but with hours < 100 ("+99:99")

Also, the SpecialPage form should reject offsets < -12 and > 14, but the API should still accept them.

This is fixed now for event creating and also editing event.

Screenshot 2023-01-20 at 12.01.35 PM.png (192ร—1 px, 27 KB)

Screenshot 2023-01-20 at 12.05.44 PM.png (180ร—1 px, 27 KB)

Screenshot 2023-01-20 at 12.15.35 PM.png (178ร—1 px, 27 KB)

confirming that API does still accept values > 14 but < 99:59

Screenshot 2023-01-20 at 1.01.01 PM.png (1ร—1 px, 171 KB)


One note, entering +0:555 will convert the minutes to a timezone offset of 9:15. Which I don't think is a bug (and is possibly a feature!)

Screen Recording 2023-01-20 at 12.18.26 PM.gif (1ร—1 px, 523 KB)

however, the API will not accept "+0:555".

Screenshot 2023-01-20 at 1.09.26 PM.png (1ร—1 px, 207 KB)

What do you think of this @Daimona? Is it worth changing in either place?

One note, entering +0:555 will convert the minutes to a timezone offset of 9:15. Which I don't think is a bug (and is possibly a feature!)
however, the API will not accept "+0:555".
What do you think of this @Daimona? Is it worth changing in either place?

Thanks, I've documented this difference in T322352. I don't think that value should be accepted by the interface because it's not a standard timezone designator, fix coming.

Change 881934 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[mediawiki/extensions/CampaignEvents@master] Do not accept malformed time zone offsets in edit registration form

https://gerrit.wikimedia.org/r/881934

Change 881934 merged by jenkins-bot:

[mediawiki/extensions/CampaignEvents@master] Do not accept malformed time zone offsets in edit registration form

https://gerrit.wikimedia.org/r/881934

โœ… GUI and api do not accept +0:555 see: T320359#8544753

Screenshot 2023-03-09 at 2.18.32 PM.png (1ร—1 px, 224 KB)

Screenshot 2023-03-09 at 2.17.43 PM.png (1ร—1 px, 165 KB)


One question @Daimona, this no longer accept time zone entries such as +1:00 and +1 or -10 and now instead requires the user to do +01:00 which I feel may be less intuitive. If we want to disallow anything that is not in XX:XX format , do you think it would it be worth guiding the user in the error message something like Enter a valid timezone in the format XX:XX? Tagging @gonyeahialam here as well.

see below:

Screenshot 2023-03-09 at 2.33.08 PM.png (646ร—1 px, 74 KB)

One question @Daimona, this no longer accept time zone entries such as +1:00 and +1 or -10 and now instead requires the user to do +01:00 which I feel may be less intuitive. If we want to disallow anything that is not in XX:XX format , do you think it would it be worth guiding the user in the error message something like Enter a valid timezone in the format XX:XX? Tagging @gonyeahialam here as well.

The placeholder for that field says Example values: "-07:00" or "01:00", I thought that would be sufficient, considering that most of the times I would expect people to use geographical time zones. The default value is also "+00:00". The error message is used in other places as well, and changing that wouldn't be entirely trivial.

One question @Daimona, this no longer accept time zone entries such as +1:00 and +1 or -10 and now instead requires the user to do +01:00 which I feel may be less intuitive. If we want to disallow anything that is not in XX:XX format , do you think it would it be worth guiding the user in the error message something like Enter a valid timezone in the format XX:XX? Tagging @gonyeahialam here as well.

The placeholder for that field says Example values: "-07:00" or "01:00", I thought that would be sufficient, considering that most of the times I would expect people to use geographical time zones. The default value is also "+00:00". The error message is used in other places as well, and changing that wouldn't be entirely trivial.

@Daimona that placeholder text is incorrect though as "01:00" is also not a valid value - it would have to be "+01:00" or "-01:00". I agree with you though that most of the time I would expect people to use geographical time zones.

Change 896338 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[mediawiki/extensions/CampaignEvents@master] Accept positive timezone offsets without + sign

https://gerrit.wikimedia.org/r/896338

@Daimona that placeholder text is incorrect though as "01:00" is also not a valid value - it would have to be "+01:00" or "-01:00". I agree with you though that most of the time I would expect people to use geographical time zones.

Aaaaarrrgh, you're right. This code is a mess. I've special-cased this.

Change 896338 merged by jenkins-bot:

[mediawiki/extensions/CampaignEvents@master] Accept positive timezone offsets without + sign

https://gerrit.wikimedia.org/r/896338

@Daimona that placeholder text is incorrect though as "01:00" is also not a valid value - it would have to be "+01:00" or "-01:00". I agree with you though that most of the time I would expect people to use geographical time zones.

Aaaaarrrgh, you're right. This code is a mess. I've special-cased this.

This is now correctly allowing 01:00 to be accepted as a time zone value

One question @Daimona, this no longer accept time zone entries such as +1:00 and +1 or -10 and now instead requires the user to do +01:00 which I feel may be less intuitive. If we want to disallow anything that is not in XX:XX format , do you think it would it be worth guiding the user in the error message something like Enter a valid timezone in the format XX:XX? Tagging @gonyeahialam here as well.

The placeholder for that field says Example values: "-07:00" or "01:00", I thought that would be sufficient, considering that most of the times I would expect people to use geographical time zones. The default value is also "+00:00". The error message is used in other places as well, and changing that wouldn't be entirely trivial.

The functionality is working correctly as described. I am sending this to @gonyeahialam for final sign off on the UX as noted above.