While working on some top secret awesomesauce, I realized that we do not properly use Form API to validate usernames in autocompletes.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | drupal.user-element-validate-name.7.patch | 4.5 KB | sun |
| #4 | drupal.user-element-validate-name.4.patch | 4.36 KB | sun |
| drupal.user-element-validate-name.patch | 4.32 KB | sun |
Comments
Comment #1
sunShould we additionally replace the element's value with the uid on successful validation, so the form submit handler gets a fully validated and resolved user id as value and doesn't have to deal with a name?
Comment #2
dries commentedBoth approaches seem valid, however this approach allows for a bit more re-use which is nice.
I'd let the validate handler focus on validating the username -- at least for now -- so no need to return anything extra IMO. It wouldn't be an elegant API, IMO.
Comment #3
sunyup - we may rethink that for D8.
But until then, this element validation handler works well for core, and there are many modules in contrib that would be happy to re-use it.
I'll jump in circles when http://api.drupal.org/api/function/node_validate/7 will be almost empty someday ;)
Comment #4
sunSlightly improved the comments.
Comment #6
damien tournoud commented#564702: The user module should use #element_validate is passing now, and also implements a (slightly smarter)
user_name_element_validate()why not merge the two?Comment #7
sunTo remove potential conflicts with #564702: The user module should use #element_validate, I renamed the #element_validate function name and added a '_autocomplete' suffix.
Makes sense.
Comment #8
mr.baileysApplied the patch and tested it locally and the patch works as advertised.
Some comments/questions after reviewing:
IMO, if this function is to be reused elsewhere, the comment should not make assumptions about how an empty, non-required, value is handled (ie empty string does not necessarily denote the anonymous user, it might just mean no user at all). Same comment for the comment within the function body.
The _autocomplete suffix feels a bit strange to me. Validation is not really related to the autocomplete portion of this element. What about user_validate_author($element)?
Comment #9
sun1 + 2) As the function name implies, this function is to validate existing user names, potentially in an autocomplete. It's possible that replacing _autocomplete with _existing might make more sense, not sure.
In general, however, this function needs a distinct suffix, so it doesn't clash with the proposed #element_validate functions proposed in #564702: The user module should use #element_validate.
3) Are you sure that the node author functionality is not tested anywhere (else)? Note that this user name form element is usually only visible to admins, so you might have looked at the wrong test. If it is really not, that would be disastrous.
Comment #10
sunComment #11
klausidoes not apply anymore
Comment #15
klausiThis code has changed so much in the meantime that we don't even validate the comment user name like that anymore. Feel free to reopen if this issue still exists.