Last modified: 2014-02-24 09:10:41 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T18864, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 16864 - Auto-login is creating accounts
Auto-login is creating accounts
Status: REOPENED
Product: MediaWiki extensions
Classification: Unclassified
CentralAuth (Other open bugs)
unspecified
All All
: Low major with 1 vote (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-01-03 00:25 UTC by Tim Starling
Modified: 2014-02-24 09:10 UTC (History)
7 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Tim Starling 2009-01-03 00:25:10 UTC
Special:AutoLogin is creating local accounts and merging them when they don't exist. It's not meant to do that. It's causing problems in conjunction with bug 14862, i.e. total breakage of Special:RenameUser. It also floods the logs. This is apparently a regression.
Comment 1 Daniel Kinzler 2009-01-03 00:27:42 UTC
It does not seem to do that always, or not for all users. At least, it has not created an account for me on en.wikiquote.org or on wikispecies, etc. 
Comment 2 Mike.lifeguard 2009-01-03 04:59:14 UTC
(In reply to comment #0)
> Special:AutoLogin is creating local accounts and merging them when they don't
> exist. It's not meant to do that. It's causing problems in conjunction with bug
> 14862, i.e. total breakage of Special:RenameUser. It also floods the logs. This
> is apparently a regression.
> 

I'm pretty sure it is supposed to create accounts automatically when you're logged in and visit wikis where you don't have an account yet (and where you already have an account, you should be logged in). If that's not what's happening, you'll have to be clearer.

It's also unclear to me how this breaks RenameUser, or how it's related to bug 14862.

Flooding the logs is the only information I understand here & I don't see how that's a big concern.
Comment 3 Tim Starling 2009-01-03 09:30:46 UTC
(In reply to comment #2)
> (In reply to comment #0)
> > Special:AutoLogin is creating local accounts and merging them when they don't
> > exist. It's not meant to do that. It's causing problems in conjunction with bug
> > 14862, i.e. total breakage of Special:RenameUser. It also floods the logs. This
> > is apparently a regression.
> > 
> 
> I'm pretty sure it is supposed to create accounts automatically when you're
> logged in and visit wikis where you don't have an account yet (and where you
> already have an account, you should be logged in). 

No it's not. You realise I wrote most of it, right?

> It's also unclear to me how this breaks RenameUser, or how it's related to bug
> 14862.

That's because I wrote this bug report with an assumption of audience familiarity with the software in question.



Comment 4 DerHexer 2009-01-03 10:30:33 UTC
(In reply to comment #2)
> I'm pretty sure it is supposed to create accounts automatically when you're
> logged in and visit wikis where you don't have an account yet (and where you
> already have an account, you should be logged in). If that's not what's
> happening, you'll have to be clearer.

Those wikis were never visited! They are automatically (per software) merged with the accounts which causes extra work for crats to rename and the account owners to request for renaming.

Regards
DerHexer
Comment 5 Mike.lifeguard 2009-01-03 14:29:00 UTC
(In reply to comment #4)
> (In reply to comment #2)
> > I'm pretty sure it is supposed to create accounts automatically when you're
> > logged in and visit wikis where you don't have an account yet (and where you
> > already have an account, you should be logged in). If that's not what's
> > happening, you'll have to be clearer.
> 
> Those wikis were never visited! They are automatically (per software) merged
> with the accounts which causes extra work for crats to rename and the account
> owners to request for renaming.
> 
> Regards
> DerHexer
> 

That's the information I was looking for; thanks.
Comment 6 Tim Starling 2009-01-03 23:17:31 UTC
Special:AutoLogin on the wiki in question is indeed requested by the browser, otherwise it wouldn't work, would it? So the wiki is visited in that sense. But the user is not aware of it. 
Comment 7 Nemo 2013-04-12 16:49:02 UTC
(In reply to comment #3)
> That's because I wrote this bug report with an assumption of audience
> familiarity with the software in question.

*raises hand from clueless audience to confirm*

Human-readable translation:
1) user registers on ru.wiki: local and global account are created;
2) user logins on wikimania wiki and the local account is automatically created;
3) as a side effect, 13 accounts are created at the same moment on all English and multilingual wikis.
(3) is the bug.
Example: https://meta.wikimedia.org/wiki/Special:CentralAuth/Awas1995
Comment 8 Nemo 2013-05-03 18:56:56 UTC
Funnier example: https://toolserver.org/~pathoschild/stalktoy/?target=Nemo+quater
It seems that on 2012-04-27 16:48 I logged in on a wiki, a local account was autocreated on 9 more and among these 1 (enwiki) is unattached per bug 29234 (and friends).
Comment 9 Nemo 2013-09-10 19:15:05 UTC
Steps as in comment 7 now produce a slightly different result: in step (3) an account was created only on one wiki, the en subdomain of the domain where I registered in step (1).
[[Special:CentralAuth/Bug 16864 test]]

This needs to be retested because currently autocreation/autologin looks broken, I had to explicitly login even on autologin wikis like Wikisource and Wiktionary in another language.
Comment 10 Chris Steipp 2013-10-07 16:31:58 UTC
With the SUL rework (and the fix in Gerrit change #84998), this no longer should happen. Users get a top-level session cookie for the project when they run the autologin code, but don't have an account created until they actually visit the the wiki in the project.
Comment 11 Nemo 2014-02-24 09:10:41 UTC
I never found time to spend a few hours trying to reproduce this bug in a way satisfactory to the devs' needs, but it's clearly not fixed. Just look at the automatic account creations on Wikiversity (lowest traffic English site), a hundred per hour: https://en.wikiversity.org/wiki/Special:Log/newusers
The typical example has 11 accounts created at once in the same minute on all English language projects, evidently upon login to one of them: [[Special:CentralAuth/Simonfransila]].

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links