User autocomplete fields don't hide blocked users [#1856476]

Due to lots of (spammy?) user names and a less than ideal sort/search algorithm, the user autocomplete fields are failing on d.o, see example:

d.o-user-autocomplete.png

1. Direct matches must be listed at the top — I can't seem to select 'sun' at all anymore...

2. Lower-case letters should be sorted above upper-case ones, because they are more likely to match relevant people (given the current distribution of names among active contributors), at least after the first letter. See http://drupal.org/site-maintainers for some anecdotal evidence. Maybe just sort all-caps names all the way to the bottom.

3. The height of the drop-down list should probably be increased.

Comment	File	Size	Author
	d.o-user-autocomplete.png	8.15 KB	salvis

Comments

Comment #1

killes@www.drop.org commented 9 December 2012 at 10:21

Project:	Drupal.org site moderators	» Project issue tracking
Version:		» 6.x-1.x-dev
Component:	Site organization	» User interface

I am not sure I am moving this to the right project, but it's clearly better than "webmasters'".

Comment #2

dww

we/he/they

commented 9 December 2012 at 18:53

Title:	User autocomplete fields don't work anymore	» User autocomplete fields don't hide blocked users
Project:	Project issue tracking	» Views (for Drupal 7)
Version:	6.x-1.x-dev	» 7.x-3.x-dev

We're just using views core's user autocomplete callbacks here. I'm not sure what project_issue is supposed to do about this. See views_ajax_autocomplete_user() in modules/views/includes/ajax.inc for more. They're intentionally doing case-insensitive matching (probably for good reason).

Agreed that an exact match would like to be first, but that'd be an extra query for every autocomplete AJAX request (probably not a good idea on a site as big/busy as d.o). If you already know the exact match, you don't have to use the autocomplete at all -- just type the name, don't use the mouse or arrow keys, and you're done.

One actionable bug report in here is that the query is not filtering out records from {users} with status blocked. Arguably, that's an information disclosure security bug (although incredibly minor). However, I'm going to unpublish this for now and open a sec.d.o issue about it, just in case the rest of the sec team cares enough to handle this as a security issue.