Page MenuHomePhabricator

Update user name widgets config to accept or deny temporary user names
Closed, ResolvedPublic

Description

Background

There are several widgets that accept user name input. These are currently configurable to accept existing user names, IP addresses and/or IP ranges.

Currently, if these widgets accept existing user names, this includes temporary user names.

We may need to specify temporary user names separately from named users.

Affected widgets
  • UserInputWidget
  • UsersMultiselectWidget
  • HTMLUserTextField

Note that due to inheritance, it may not be necessary to make changes to all widgets.

Event Timeline

Basically the user-related form fields need two extra optional boolean paramaters onlynamed / onlytemp (or something like that) which

  • apply an extra validation check to the users on submit, and rejects the appropriate user type
  • onlytemp adds an extra auprefix=* parameter to the list=allusers API call for the autocomplete search
  • onlynamed skips the autocomplete when the typed text starts with *

(Alternatively, temp/named filtering could be added to the list=allusers API and the form could make use of that. That's nicer in general but has an ugly edge case which is not relevant for the form fields: when iterating through users with onlynamed=1 and no auprefix, you'd end up with a query like SELECT * FROM user WHERE user_name >= $offset AND user_name NOT LIKE '*%' LIMIT $limit and that query will perform catastrophically poorly when iteration reaches to usernames starting with *.)

Change 947359 had a related patch set uploaded (by TsepoThoabala; author: TsepoThoabala):

[mediawiki/core@master] Update user name widgets config to accept or deny temporary user names

https://gerrit.wikimedia.org/r/947359

@TThoabala Thanks for the patch! This seems like good advice, but I notice the patch only does the first one:

Basically the user-related form fields need two extra optional boolean paramaters onlynamed / onlytemp (or something like that) which

  • apply an extra validation check to the users on submit, and rejects the appropriate user type
  • onlytemp adds an extra auprefix=* parameter to the list=allusers API call for the autocomplete search
  • onlynamed skips the autocomplete when the typed text starts with *

Just wondered if there was a reason behind this?

Change #1054960 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/CentralAuth@master] Update user name widgets config to accept or deny temporary user names

https://gerrit.wikimedia.org/r/1054960

Change #1054961 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/core@master] Update user name widgets config to accept or deny temporary user names

https://gerrit.wikimedia.org/r/1054961

Amdrel changed the task status from Open to In Progress.Jul 19 2024, 8:05 PM
kostajh removed a subscriber: TThoabala.

Change #1054961 merged by jenkins-bot:

[mediawiki/core@master] Update user widgets to support named and temp account exclusion

https://gerrit.wikimedia.org/r/1054961

Change #947359 abandoned by Kosta Harlan:

[mediawiki/core@master] Update user name widgets config to accept or deny temporary user names

Reason:

I6563ae610017fd1cd35c36ba65906041f7f68c4b

https://gerrit.wikimedia.org/r/947359

kostajh subscribed.

Is GlobalUserInputWidget (PHP and JS widget from CentralAuth) used anywhere?

Change #1054960 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Update user name widgets config to accept or deny temporary user names

https://gerrit.wikimedia.org/r/1054960

Is GlobalUserInputWidget (PHP and JS widget from CentralAuth) used anywhere?

Yeah it is. It's used by HTMLGlobalUserTextField->getInputWidget, and HTMLGlobalUserTextField is used in the form field descriptors in the following special pages:

  • Special:CentralAuth
  • Special:CreateLocalAccount
  • Special:GlobalGroupMembership
  • Special:GlobalRenameUser
Djackson-ctr subscribed.

QA has been completed, and the new code changes are functioning as expected for the affected widgets (API for 'globalallusers' allows filtering of accounts using the parameters 'excludetemp' and 'excludenamed').