335573 - Authors field in addons form unclear, SQL uses wildcard

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Michael Morgan [:morgamic]]

The upload form (additem.php) mistakingly assigns the incorrect author ID with a given addon.  This is caused by some messed up queries/logic in additem.php around:
http://lxr.mozilla.org/update1.0/source/developers/additem.php#465

Working on fixing this to avoid incorrect relationships in authorxref, the map table between userprofiles and main (authors and addons, respectively).

Comment 1

[Michael Morgan [:morgamic]]

Case in point:
12:13 < Hannibal> morgamic: Hermann here (id 10286) says he submitted extension id 2409
12:14 < Hannibal> which is then listed as written by someone else
12:14 < morgamic> hmm.
12:14 < Hannibal> specifically, author id 789

Hermann uploaded:
https://addons.mozilla.org/firefox/2409

And instead of being mapped to his author profile:
https://addons.mozilla.org/author.php?id=10286

It instead is mapped to:
https://addons.mozilla.org/author.php?id=789

At this point, I've looked through and the #465 problem isn't it -- the comparison is on UserEmail, which is pulled from the database based on a join between main and userprofiles (authorxref).

The source of the incorrect user mapping is still up for grabs -- trying to analyze where it's coming from.

Comment 2

[Michael Morgan [:morgamic]]

I'll hold off on this until I can figure out the path Hermann took from beginning to end -- he might be a special case.

Comment 3

[alanjstr]

overlapping GUID?

Can we get the xpi attached here?

Comment 4

[Michael Morgan [:morgamic]]

Hermann had entered in his name as his email, which matched another user's email because of the wildcard in line #465.

Comment 5

[Mike Shaver (:shaver emeritus)]

morgamic: if this hasn't already been fixed (I thought maybe it had?), let's make sure we get it by 2.1 at the latest.

Comment 6

[Justin Scott [:fligtar]]

In Remora (AMO v3), authors are added via an AJAX system that checks for and displays the name of the valid AMO account before the page is submitted, so this should not be a problem.

Comment 7

[Justin Scott [:fligtar]]

That's right morgamic, I just stole your ASSIGNED bug, what are you gonna do about it?