Page MenuHomePhabricator
Create Task
Maniphest T372880

User::isAllowed throws from CentralAuthUser when username contains colon
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

See e.g.
https://tr.wikipedia.org/wiki/%C3%96zel:Katk%C4%B1lar/Szy:)
https://tr.wikipedia.org/wiki/Kullan%C4%B1c%C4%B1:Szy:)
https://tr.wikipedia.org/w/index.php?title=Kullan%C4%B1c%C4%B1:Szy:)&action=edit&redlink=1

Stack trace is CentralAuth-related:

[48f55398-3da4-4e65-9d15-210f31aceb94] /wiki/%C3%96zel:Katk%C4%B1lar/Szy:)   InvalidArgumentException: Invalid username: Szy:)
from /srv/mediawiki/php-1.43.0-wmf.15/extensions/CentralAuth/includes/User/CentralAuthUser.php(251)
#0 /srv/mediawiki/php-1.43.0-wmf.15/extensions/CentralAuth/includes/User/CentralAuthUser.php(228): MediaWiki\Extension\CentralAuth\User\CentralAuthUser::getInstanceByName(string)
#1 /srv/mediawiki/php-1.43.0-wmf.15/extensions/CentralAuth/includes/CentralAuthHooks.php(405): MediaWiki\Extension\CentralAuth\User\CentralAuthUser::getInstance(MediaWiki\User\User)
#2 /srv/mediawiki/php-1.43.0-wmf.15/includes/HookContainer/HookContainer.php(159): MediaWiki\Extension\CentralAuth\CentralAuthHooks->onUserGetRights(MediaWiki\User\User, array)
#3 /srv/mediawiki/php-1.43.0-wmf.15/includes/HookContainer/HookRunner.php(4265): MediaWiki\HookContainer\HookContainer->run(string, array)
#4 /srv/mediawiki/php-1.43.0-wmf.15/includes/Permissions/PermissionManager.php(1588): MediaWiki\HookContainer\HookRunner->onUserGetRights(MediaWiki\User\User, array)
#5 /srv/mediawiki/php-1.43.0-wmf.15/includes/Permissions/PermissionManager.php(1536): MediaWiki\Permissions\PermissionManager->getUserPermissions(MediaWiki\User\User)
#6 /srv/mediawiki/php-1.43.0-wmf.15/includes/Permissions/UserAuthority.php(285): MediaWiki\Permissions\PermissionManager->userHasRight(MediaWiki\User\User, string)
#7 /srv/mediawiki/php-1.43.0-wmf.15/includes/Permissions/UserAuthority.php(144): MediaWiki\Permissions\UserAuthority->internalAllowed(string, NULL, boolean, NULL)
#8 /srv/mediawiki/php-1.43.0-wmf.15/includes/user/User.php(2191): MediaWiki\Permissions\UserAuthority->isAllowed(string, NULL)
#9 /srv/mediawiki/php-1.43.0-wmf.15/includes/user/User.php(1433): MediaWiki\User\User->isAllowed(string)
#10 /srv/mediawiki/php-1.43.0-wmf.15/includes/user/User.php(1526): MediaWiki\User\User->getBlock()
#11 /srv/mediawiki/php-1.43.0-wmf.15/includes/specialpage/ContributionsSpecialPage.php(401): MediaWiki\User\User->isHidden()
#12 /srv/mediawiki/php-1.43.0-wmf.15/includes/specialpage/ContributionsSpecialPage.php(219): MediaWiki\SpecialPage\ContributionsSpecialPage->contributionsSub(MediaWiki\User\User, string)
#13 /srv/mediawiki/php-1.43.0-wmf.15/includes/specialpage/SpecialPage.php(719): MediaWiki\SpecialPage\ContributionsSpecialPage->execute(string)
#14 /srv/mediawiki/php-1.43.0-wmf.15/includes/specialpage/SpecialPageFactory.php(1693): MediaWiki\SpecialPage\SpecialPage->run(string)
#15 /srv/mediawiki/php-1.43.0-wmf.15/includes/actions/ActionEntryPoint.php(502): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#16 /srv/mediawiki/php-1.43.0-wmf.15/includes/actions/ActionEntryPoint.php(145): MediaWiki\Actions\ActionEntryPoint->performRequest()
#17 /srv/mediawiki/php-1.43.0-wmf.15/includes/MediaWikiEntryPoint.php(200): MediaWiki\Actions\ActionEntryPoint->execute()
#18 /srv/mediawiki/php-1.43.0-wmf.15/index.php(58): MediaWiki\MediaWikiEntryPoint->run()
#19 /srv/mediawiki/w/index.php(3): require(string)
#20 {main}

Happens with some other usernames with : in them too (e.g. https://it.wikipedia.org/wiki/Utente:DP_:_Les_Victorieux_de_la_Ligue_Sinnoh ) but not with an arbitrary URL (maybe the user has to exist?).

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Fix exceptions on users with invalid usernamesBartosz Dziewońskimediawiki/extensions/CentralAuthmaster+26 -15
Customize query in gerrit

Related Objects

Event Timeline

Tgr created this task.Aug 20 2024, 11:58 AM
Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptAug 20 2024, 11:58 AM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Bugreporter subscribed.Aug 20 2024, 12:21 PM

szy: is a language prefix; in itwiki, dp: is an alias to project namespace. So such user names are invalid. They should be renamed to something valid.

Aklapper changed the subtype of this task from "Bug Report" to "Production Error".Aug 21 2024, 8:17 AM
• larissagaulia moved this task from Inbox, needs triage to DO NOT USE (was: Not planned) on the MediaWiki-Core-Platform-Team board.Aug 26 2024, 2:45 PM
• matmarex claimed this task.Aug 26 2024, 5:10 PM
• matmarex moved this task from DO NOT USE (was: Not planned) to In progress (DO NOT USE) on the MediaWiki-Core-Platform-Team board.
• matmarex subscribed.

When triaging this, we talked about differences in namespace configuration and how that would cause username validity rules to be different between different wikis, and whether fake namespaces at the start of usernames should be validated at all – but that's a red herring, as people already ran into this problem a long time ago and solved it by just disallowing colons in usernames: T98757: Username validity depends on per-wiki configuration (namespaces, etc.)

So the colon makes them invalid, and they've been invalid for almost 10 years. But what's interesting is that you can still use an account with an invalid username, if you've got one, you just can't register new ones – I tested locally, and I could log in, make edits, and do everything else I thought of. It's only the management interface of CentralAuth that rejects them. Given that everything else accepts them, there's probably an easy fix.

(It's also interesting that we never tried to force them to be renamed, but I guess it'd be disruptive to these users, and the software supports them, so there wasn't a compelling reason. There's an old task with discussion about it but not actions taken: T160296.)

thcipriani moved this task from Untriaged to Aug 2024 on the Wikimedia-production-error board.Aug 29 2024, 3:25 PM
• matmarex added a comment.Sep 1 2024, 2:45 PM

Actually, my last comment was incorrect about an important detail – usernames with colors are not creatable, but valid if they already exist; while usernames prefixed with a namespace and both not creatable and not valid, even if they already exist. This is honestly quite annoying. CentralAuth and MediaWiki both have problems with the latter type – you actually can't log in with an invalid (not just uncreatable) username, and some special pages like Special:UserRights will say that it doesn't exist, while others like Special:Contributions can handle it just fine.

gerritbot added a comment.Sep 1 2024, 2:46 PM

Change #1069684 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Fix exceptions on users with invalid usernames

https://gerrit.wikimedia.org/r/1069684

gerritbot added a project: Patch-For-Review.Sep 1 2024, 2:46 PM
Tgr added a comment.Sep 9 2024, 3:20 AM
In T372880#10093187, @matmarex wrote:

But what's interesting is that you can still use an account with an invalid username, if you've got one, you just can't register new ones – I tested locally, and I could log in, make edits, and do everything else I thought of.

There are four levels of validity, somewhat described in UserRigorOptions:

  • RIGOR_CREATABLE: can be used to register a new account
  • RIGOR_USABLE: cannot be used to register a new account, but otherwise usable for anything (including autocreating a local account if the central account already exists)
  • RIGOR_VALID: cannot be used by its owner (not allowed to log in) but can be present in the wiki and code that operates on revisions, username form fields etc. should be prepared to handle it
  • RIGOR_NONE: totally invalid; in theory, code other than input sanitization code should never encounter it. (In practice, clearly not the case.)

The bug here is with RIGOR_NONE level usernames.

gerritbot added a comment.Sep 12 2024, 1:32 AM

Change #1069684 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Fix exceptions on users with invalid usernames

https://gerrit.wikimedia.org/r/1069684

ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.23; 2024-09-17).Sep 12 2024, 2:00 AM
Maintenance_bot removed a project: Patch-For-Review.Sep 12 2024, 2:30 AM
• matmarex closed this task as Resolved.Sep 12 2024, 11:44 AM
Tgr mentioned this in T377588: CentralAuthIdLookup throws from CentralAuthUser for username with a colon.Oct 18 2024, 4:46 PM
Bugreporter mentioned this in T401212: WMF wikis CentralAuth database tables have rows for invalid username "Nr: 135".Dec 16 2025, 9:25 AM
Krinkle renamed this task from Exceptions thrown when username contains colon to CentralAuthUser::getInstanceByName throws exception when username contains colon (Aug 2024).Dec 16 2025, 7:07 PM
Krinkle renamed this task from CentralAuthUser::getInstanceByName throws exception when username contains colon (Aug 2024) to CentralAuthUser::getInstanceByName with RIGOR_NONE throws exception when username contains colon (Aug 2024).
Krinkle renamed this task from CentralAuthUser::getInstanceByName with RIGOR_NONE throws exception when username contains colon (Aug 2024) to User::isAllowed throws CentralAuthUser when username contains colon.Dec 16 2025, 7:36 PM
Krinkle renamed this task from User::isAllowed throws CentralAuthUser when username contains colon to User::isAllowed throws from CentralAuthUser when username contains colon.Dec 16 2025, 7:48 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits