Page MenuHomePhabricator

Do account creation checks when creating users
Closed, DeclinedPublic


It doesn't look like SpecialOpenIDLogin.body.php is doing the same checks that MediaWiki core is doing on account creation. I'm not sure if vandals could abuse this, but it would be good to check.

Specific checks that need to happen (apologies if I've missed these somewhere else):

  • Username needs to valid against the 'creatable' checks, so some thing like

$u = User::newFromName( $name, 'creatable' );
if ( !is_object( $u ) ) {

		return null;
  • The AbortNewAccount hook should be run
  • IP throttle needs to be checked
  • Make sure the email passes Sanitizer::validateEmail()


Version: master
Severity: normal
See Also:



Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 2:20 AM
bzimport set Reference to bz54677.

Thanks for reporting and giving starting points. I will try to fix this as soon as possible.

Change 95076 had a related patch set (by Wikinaut) published:
Bug 54677: Do account creation checks when creating users

Change 95076 merged by Wikinaut:
Bug 54677: (partial) check email addresses Sanitizer::validateEmail()

Aklapper subscribed.

[Resetting task assignee to avoid cookie-licking. Please reclaim the task when you plan to actively work on this task. Thanks!]