Last modified: 2011-05-15 10:04:18 UTC
The current state is, if enwiki blacklists A but dewiki doesn't, a user can register the name A on dewiki, then autocreate the name A on enwiki. Ideally, the name can exist on dewiki, but cannot be autocreated on enwiki. I tried to implement this in r67347 and it's CentralAuth-specific (not really sure whether this is good). Besides, this can actually work only after bug 24755 is fixed. Assigning this bug to myself, but nothing really need to be done after bug 24755 is fixed, unless the "CentralAuth-specific" feature needs reconsideration.
I think that CentralAuthHooks::attemptAddUser() should call AbortNewAccount not (just) an extension specific CentralAuthAutoCreate
IIRC, we need them to be separate in part so we can still have things like AntiSpoof preventing initial account creation, while still allowing an account that's been explicitly allowed in by a sysop or grandfathered in to work as expected.
r85410 covers this: * (bug 24755) AuthPlugin auto-creation of local accounts can now be aborted by other extensions by handling the 'AbortAutoAccount' hook, similar to the 'AbortNewAccount' triggered by explicit account creations. (They are separate to avoid loops and confusion; auth plugins like CentralAuth need to handle AbortNewAccount separately.
