Closed (outdated)
Project:
Drupal core
Version:
7.x-dev
Component:
user.module
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
5 Jul 2010 at 13:19 UTC
Updated:
7 Aug 2010 at 06:53 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
lyricnz commentedBug not present in D7 - validate shows "You must enter a username."
Comment #2
damien tournoud commentedComment #3
lyricnz commentedBug not present in D7
Comment #4
lyricnz commentedChanged user_validate_name() to match D7.
Comment #5
jbrown commentedD7 user_validate_name() is wrong.
0 should be a valid user name.
Comment #6
lyricnz commentedIt looks like the D6 maintainer deliberately made this change when he committed a cleanup to this code in http://drupal.org/node/266488#comment-2985980
So there's either:
1) A bug in D6 that allows "0" as a username, but doesn't quite support this properly (see screenshot).
2) A bug in D7 that doesn't allow "0" as a username (while D6 does). Actual support for that is not tested.
3) An upgrade problem if the validation in D7 is more strict than D6 (user "0")
Either way, contributed modules are known to make this same mistake "if ($user->name)". I vote for not allowing "0" in either version - this is no more arbitrary than not allowing leading/trailing spaces, double spaces within strings, or any of the more exotic characters.
Comment #7
lyricnz commentedOops - crosspost.
@jbrown: so you are suggesting there is a bug in D6 (screenshot), and in D7 (not supporting "0"), and in contributed modules that use "if ($user->name)"?
Comment #8
jbrown commentedYes #7 is exactly what I am suggesting.
form.inc checks for (strlen(trim($elements['#value'])) != 0) for required fields.
I don't know why the user code doesn't just leave it up to the forms layer to determine if it has been entered.
Code that needs to determine if an account is anonymous should examine uid, not name.
"0" being considered as an empty string is one of the reasons why people think PHP is a really crap language.
Comment #9
jensimmons commentedIt makes sense to me to not allow people to use the username "0". I can't see a compelling reason to allow it. It seems like a hacker or troll thing to do. Normal use of Drupal usernames doesn't need this ability.
That said, I don't have my head wrapped around the backend implications of whatever choice.
Comment #10
lyricnz commentedOkay, I've asked around, and the general consensus seems to be that "0" should be a valid username. That being the case, here's a patch against D7 that fixes some bugs caused by user "0".
- format_username() showing "Anonymous" instead of "0". This shows up on the user-list, for example.
- page title on the user page for "0" not showing correctly
- menu title (next to tabs) on the user page for "0" not showing correctly
- various bugs with page titles of "0", in theming
Of course, this requires the patch at http://drupal.org/node/266488#comment-3171358 to be applied before you can create such a user :)
Comment #11
chx commentedPresuming $account->name or anything to be a string is a very dangerous assumption especially when dealing with zeroes.
0 == '',0 == '0'and only'0' != ''. Use!==everywhere. It's faster to boot and leaves no doubts.Comment #12
lyricnz commentedThanks
Comment #13
rfayLet's not spill too much blood on this one. It's not important in the big picture and it's worth fixing.
I don't object to this patch, but it doesn't solve all the contrib uses of the same pattern that are out there. There's no reason to allow '0' as a username, and disallowing it prevents all those uses from being problematic.
Comment #14
jbrown commentedformat_username()'s technique of checking the username to determine if an account is a guest account is totally wrong. template_preprocess_username() does it correctly: checking the uid.
Okay - this snippet:
doesn't return TRUE!
Assuming that $string is actually a string, the correct way to test that it is empty is
To test if it is not empty:
A more elaborate test like strlen(trim($string)) == 0) could be used that would handle integer variables, but would be impracticable in theme templates and is unnecessary.
It seems that there are lots of places in core where empty strings are not being correctly tested for.
The attached patch builds on #12, fixing use of $title in bartik and fixing format_username().
Comment #15
jbrown commented#871160: Define programming best practices for determining if a string is empty
Comment #16
jbrown commentedComment #18
jbrown commentedComment #19
lyricnz commentedLooks good, passes tests - allows account name of "0" without bad behavior (if this is decided to be disallowed, this code is still fine)
Comment #20
chx commentedHrm, #11 was too long ago. Then let me repeat: for readability and speed (and disambiguity) !== is much better than !=.
Comment #21
jbrown commentedYes,
$variable !== ''will return FALSE if $variable is not a string.I think this form should always be used if the assumption is that $variable should be a string.
Comment #22
sunAgreed with chx here, otherwise looks good.
Comment #23
jbrown commentedJust browsing through Seven and Bartik, there are dozens of examples of
where it should be
Should this be standardized and fixed?
#871160: Define programming best practices for determining if a string is empty
Comment #24
chx commentedYes, yes, yes! It should definitely be standardized and fixed. I called for that at my Paris talk about how broken == is.
Comment #25
lyricnz commentedAgree. Please let's fix D7 before release - this issue causes a few silly impacts, like mishandling users called "0" etc.