493302 - Extension allows new users to login before confirming their email id

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: API, defect, P3)

Description

[krupa raj[:krupa]]

steps to reproduce:
1.Register as a new AMO
2.After successful form submission ,you are requested to validate your email id by clicking on the email sent to you.
3.Before validating that,Go to Tools->Addons->Subscriptions
4.Try to login to your newly created AMO account

expected result:
User is not able to login to the newly created account before validating their email id

actual results:
user is able to login.

Comment 1

[Justin Scott [:fligtar]]

There are two parts to this bug:
* the API should not allow unconfirmed users to login and should return an appropriate error code
* the extension will need a new string added to explain that error to the user

Since I don't want to add any new strings to the extension for this version and the current functionality is OK, we'll keep this around for the next version.

Comment 2

[Brian King [:kinger]]

(In reply to comment #1)
> There are two parts to this bug:
> * the API should not allow unconfirmed users to login and should return an
> appropriate error code
> * the extension will need a new string added to explain that error to the user

Over to Les for the first part, but please note...

> Since I don't want to add any new strings to the extension for this version and
> the current functionality is OK, we'll keep this around for the next version.

Comment 3

[Justin Scott [:fligtar]]

I added a new error string for the extension called login.unconfirmed in extensionOverlay.properties with 1.0.3's l10n since managing l10n for updates is such a pain.

Comment 4

[Justin Scott [:fligtar]]

So, to clarify for Les, this bug is about returning an error if a user with an unconfirmed account tries to log in.

Comment 5

[Les Orchard [:lorchard]]

Will hopefully have time to look at this in the next week or two.  

For clarity: Can you guys file API blocker bugs separate from extension bugs - or am I actually going to be looking into extension code?

Comment 6

[Les Orchard [:lorchard]]

So, I'm actually working on this now - not sure why I was removed from the assigned-to

Comment 7

[Les Orchard [:lorchard]]

Attachment: Disallow logins from unverified users

This should prevent unverified accounts from logging in

Comment 8

[Les Orchard [:lorchard]]

r48773

Comment 9

[krupa raj[:krupa]]

Now,new users cant log in to the collector without confirming their email address.

However the error message says-"..Please check your username and password" which might be confusing to the user.Expected error message would be-"This account is unconfirmed.You need a confirmed AMO account to log into AMO collector"

If this is something we don't care about fixing,please mark the bug resolved again and I'll verify it.

Comment 10

[Brian King [:kinger]]

(In reply to comment #9)
> If this is something we don't care about fixing,please mark the bug resolved
> again and I'll verify it.

-> Justin for judgement.

Comment 11

[Justin Scott [:fligtar]]

Yes, please use the new string for this that I added in comment #3.

Comment 12

[Wil Clouser [:clouserw]]

What's the status of this?  I want to kick it out of 5.0.9 since we're in code freeze now.

Comment 13

[Wil Clouser [:clouserw]]

Closing as the collector extension was EOL'd