Page MenuHomePhabricator

Aligning Phabricator account restrictions with Wikimedia's
Closed, DeclinedPublic

Description

Reported upstream: https://secure.phabricator.com/T6003 (Wontfix)

@Jalexander says: Is there a particular reason why Phabricator can't have the same username requirements as mediawiki so that people can easily have ACTUAL SUL and use the same name everywhere?

Looking here and here it looks like a sure problem will be spaces and parenthesis, especially now that WMF employees are being enforced to use "Username (WMF)" for work.

There might be other frequent cases, but we haven't identified them yet.

Phabricator lets you create an account with an alternative spelling (i.e. "Philippe-WMF" instead of "Philippe (WMF)"). If username accounts can be edited at a later stage (?) then a short term option is to ask users for some patience and imagination while we resolve this issue upstream in the best way technically possible.

Details

Reference
fl562

Event Timeline

flimport raised the priority of this task from to Medium.Sep 12 2014, 1:46 AM
flimport set Reference to fl562.

aklapper wrote on 2014-08-27 15:05:37 (UTC)

Copying the full upstream reply here:

<epriestley> there is no strong technical reason. One thing that would break is that we use usernames in URLs in some cases, but also parse [] notation in URLs (like PHP does). Generally, we reserve symbols from identifiers to allow for future expansion to syntax and to make the product easier for users to use.
<epriestley> On expansion, we recently added "#project" as syntax, but that wouldn't have been possible if we allowed "#" in usernames.
<epriestley> On ease of use, there is also no technical reason that usernames can not contain unicode, but many users would have difficulty typing, e.g., mandarin glyphs.
<andre__> so if we locally allowed () brackets in usernames, we might at some point run into issues once Phab starts to use them too
<epriestley> Right. We assume we're safe to use anything that we forbid, so we might add a feature later which conflicts.
We have various parsers and tokenizers which also assume the input is only allowed characters.
For example, I think when you type "ASDF (QWER)" into a typeahead, we actually search for "asdf" and "qwer".
But that's possibly incorrect if "(" and ")" are permitted tokens in usernames.
<epriestley> I think nothing too terrible will happen (other characters like space, comma, or ampersand would cause a lot more problems), so if the benefit of allowing them locally is significant I doubt it will create any major problems down the road.

Rush wrote on 2014-08-27 16:43:22 (UTC)

We kind of ran up against this same thinking for another idea we (I?) had which was to use symbols in projects pre-icons-everywhere, and the determination was getting ourselves into hot water by using symbols that can be allocated for some other purpose within the phab universe at any time is not worth the hassle.

You can actually change usernames but it is super messy at the moment, all references to the old username are just dead at that point I believe. If we addressed the character limitation issue and somehow got renames be more friendly down the road then maybe?

Whether this is required or not seems outside my area but I am pretty averse to getting into the spaces and brackets game for names as it stands now.

qgil wrote on 2014-08-27 17:16:49 (UTC)

Question: can Phabricator accept non-Latin scripts in usernames? If not, then we can just give up on details like spaces until this problem is solved upstream.

fwiw the forbidden characters in MediaWiki usernames are

< > [ ] | { }  # / @

plus some weird Unicode characters plus other restrictions described here.

Personally, I think that it is not a big deal to be Qgil-WMF in Phabricator. Our Wikimedia usernames are supposed to be shown as well for accuracy. Forking upstream for this reason might kick back in the future.

Jalexander wrote on 2014-08-27 17:37:44 (UTC)

To be honest from what I can tell in the reply from upstream the bigger question here is the non latin scripts which they don't appear to support. Given that we are a very international organization with 100s of thousands (if not millions) of accounts that are traditionally in arabic/Chinese/Japanese etc that seems like the piece most likely to piss a large group off.

qgil wrote on 2014-08-27 18:13:50 (UTC)

I've marked T422 a blocker of this task because I think we need to see the UI of that feature to understand what is the actual impact of this problem. Phabricator is not MediaWiki, and editors might be able to understand this very simple point as long as their Wikimedia identity is clear and visible.

qgil wrote on 2014-08-28 21:01:34 (UTC)

At least for the "Foo (WMF)" case there is already a recommendation to use "Foo-WMF" for Right-to-Left wikis. Therefore, it wouldn't be that bad an unprecedented to use Qgil-WMF in Phabricator.

qgil wrote on 2014-08-29 20:54:33 (UTC)

Support for non-Latin characters in usernames, requested upstream: https://secure.phabricator.com/T6003

qgil wrote on 2014-08-30 20:54:46 (UTC)

Extensive reply upstream explaining why they support Latin only, why they discourage us to pursue wider Unicode, and how we can skip the limitation if we want:

If WMF wants to allow these names, you can change PhabricatorUser::validateUsername() locally. If the usernames are required to pass checks in MediaWiki, that may mitigate some of the most extreme issues. However, it will still be difficult to assign a review to "☢" and mentioning that user with "@☢" won't work. Beyond this, I don't think anything too catastrophic will happen, but I'd still generally discourage this.

Basically, Phabricator is better compared to Bugzilla and Gerrit, where we have 1000s of Wikimedians basically playing with the same limitations. Twitter, Facebook, etc share these limitations, so it will be hardly new for any user to find a Latin-scrip version. They can still use other scripts in the Real name field if they wish, and they will have a visible link to their Wikimedia usernames anyway.

Upstream will not do it, and I don't think we should fork away our own homebrewed solution for a feature as core as usernames. Declined?

Rush wrote on 2014-09-02 16:26:09 (UTC)

agreed, I would think this all leads to declined

qgil wrote on 2014-09-02 16:49:06 (UTC)

Wontfixed upstream, Declined here. I will document the policy for usernames at https://www.mediawiki.org/wiki/Phabricator/Help

Reading Phabricator team's reply https://secure.phabricator.com/T6003, I've spotted

If WMF wants to allow these names, you can change PhabricatorUser::validateUsername() locally.

Has it been considered?

We can use the wikis' usernames list to check is an username is allowed. That would allow much more flexibility: we would potentially have much more people participating on Phabricator, just by logging-in using their wiki SUL account.

I don't know is the Wikimedia Space is going to use Phabricator's login system, but if so, we are going to block a lot of people from participating.

Has it been considered?

Not that I know, and not that I am aware of someone who has volunteered yet to maintain that downstream code change for literally ever.

I don't know is the Wikimedia Space is going to use Phabricator's login system

It shall not: T215052