As described in T349503: Update the serial mapping config for generating temporary user names on beta, the TempUserCreator::acquireName method uses SerialProvider::acquireIndex in a way that assumes it will always return an integer that has never been used before. However, the documentation for this method says the index is instead unlikely to be used again.
As discussed at T349503, this means that the TempUserCreator::create and TempUserCreator::acquireAndStashName methods must handle the situation where an index is returned that has previously been used. This code currently causes issues because this assumption means that a user can be logged in to an already existing temporary account on a collision.
Steps to replicate the issue
These steps are aimed at a local testing wiki
- Disable temporary account creation (if enabled)
- Run one of the following SQL:
- If using CentralAuth, run the SQL in 2A on the centralauth DB
- If not using CentralAuth, run the SQL in 2B on the local wiki DB
SELECT uas_value FROM global_user_autocreate_serial WHERE uas_shard = 0;
SELECT uas_value FROM user_autocreate_serial WHERE uas_shard = 0;
- Keep a track of the result of the query 2A or 2B. If query 2A or 2B returned no rows, then take this number as 1.
- Create an account with the username that matches the temporary account format, using the number from step 3. This should usually be *Unregistered X where X is the integer from step 3, though the format will change with T349494.
- Log out of the new account
- Re-enable temporary account creation, with the serialMapping key defined with a value of [ 'type' => 'plain-numeric', 'numShards' => 1 ]
- Go to any page, and open the edit window.
- Make some changes and press save
What happens?:
The edit fails to save with the Username entered already in use error displayed:
When loading any other page after this occurs, I am now logged in to that temporary account. As shown by the Special:Contributions page, this account has no contributions (so the edit did not go through):
What should have happened instead?:
The edit form should display an error if after a few attempts it fails to get a temporary account username that isn't already in use.
QA Results - Local
| AC | Status | Details |
|---|---|---|
| 1 | ✅ | https://phabricator.wikimedia.org/T353390 here |
