625163 - Unconfirmed user is shown as signed in during AAQ

Status: RESOLVED WONTFIX

(support.mozilla.org :: Questions, task)

Description

[Rebecca Billings [:rbillings]]

During the AAQ flow, if a new user registers, they are then shown as being signed in while filling out question details. Links display for profile and sign out, and user can view their profile- prior to confirming.

1) /questions/new
2) ask question
3) fill out new user registration fields
4) fill out question details- check sign in status on this page

expected: not signed in
actual: signed in, with a profile

Comment 1

[Paul Craciunoiu [:paulc]]

I'm tempted to WONTFIX this, as we actually need request.user to be filled in when they ask the question (creator=request.user), so we need to authenticate them. They are only signed in on the last step of the AAQ and disallowed from doing anything anywhere else - it's contained. This was all part of bug 614011.

James, thoughts?

Comment 2

[James Socol [:jsocol, :james]]

Technically, this is working as intended. They are temporarily signed in.

I don't know that it's possible to not sign them in. Can we have a session, to which we could attach the new User object, without signing them in? If so, maybe we can drag the new User along that way, rather than signing them in and using request.user.

This is low priority, but it beats going through and making sure that everything else checks .is_active. However, if there's not a way to do it, we'll just WONTFIX.

Comment 3

[Paul Craciunoiu [:paulc]]

(In reply to comment #2)
> I don't know that it's possible to not sign them in. Can we have a session, to
> which we could attach the new User object, without signing them in? If so,
> maybe we can drag the new User along that way, rather than signing them in and
> using request.user.
Hm, how about just not showing they are signed in in the top right, when user.is_active=False?
That's a much easier fix. It's not "true", but do you see a problem with it?

Comment 4

[James Socol [:jsocol, :james]]

(In reply to comment #3)
> Hm, how about just not showing they are signed in in the top right, when
> user.is_active=False?
> That's a much easier fix. It's not "true", but do you see a problem with it?

There is no reason to hack a solution to this. If we can attach the user to the session without signing them in, that's the right thing to do. If not, I see no reason to hack something mediocre together.

Comment 5

[Tiziana Sellitto [:tiziana]]

I've reproduced this and noticed that the behavior is the same reported from the reporter.
Is this still valid?

Comment 6

[Kadir Topal [:atopal]]

While this is not the cleanest way of doing things, I don't see a particular problem with it.