978978 - Theme submission fails with a 500 for users with usernames longer than 32 characters

Status: RESOLVED INCOMPLETE

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[krupa raj[:krupa]]

usernames used:
Vásárlási_lehetőségek_konfigurálása
"'><script>alert('problem')</script>

steps to reproduce:
1. Go to https://addons.allizom.org/en-US/developers/theme/submit
2. Submit a theme named Vásárlási_lehetőségek
3. Enter all the required fields and click submit

observed behavior:
Submission fails with a 500.

https://addons.allizom.org/en-US/developers/theme/submit [HTTP/1.1 500 INTERNAL SERVER ERROR 3233ms]

Comment 1

[Jason Thomas [:jason]]

https://rpm.newrelic.com/accounts/315282/applications/2799916/traced_errors/1348524740?tw[end]=1393883855&tw[start]=1393882055

Traceback (most recent call last):
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/newrelic-2.4.0.4/newrelic/hooks/framework_django.py", line 485, in wrapper return wrapped(*args, **kwargs)
File "/data/addons-stage/www/addons.allizom.org/deploy-zamboni-stage-20140228221402-77240a2995/zamboni/apps/amo/decorators.py", line 157, in wrapper return f(*args, **kw)
File "/data/addons-stage/www/addons.allizom.org/deploy-zamboni-stage-20140228221402-77240a2995/zamboni/apps/amo/decorators.py", line 149, in wrapper return f(*args, **kw)
File "/data/addons-stage/www/addons.allizom.org/deploy-zamboni-stage-20140228221402-77240a2995/zamboni/apps/amo/decorators.py", line 32, in wrapper return func(request, *args, **kw)
File "/data/addons-stage/www/addons.allizom.org/deploy-zamboni-stage-20140228221402-77240a2995/zamboni/apps/devhub/views.py", line 1716, in submit_theme addon = form.save()
File "/data/addons-stage/www/addons.allizom.org/deploy-zamboni-stage-20140228221402-77240a2995/zamboni/apps/addons/forms.py", line 552, in save p.save()
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/django/db/models/base.py", line 463, in save self.save_base(using=using, force_insert=force_insert, force_update=force_update)
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/django/db/models/base.py", line 551, in save_base result = manager._insert([self], fields=fields, return_id=update_pk, using=using, raw=raw)
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/django/db/models/manager.py", line 203, in _insert return insert_query(self.model, objs, fields, **kwargs)
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/django/db/models/query.py", line 1593, in insert_query return query.get_compiler(using=using).execute_sql(return_id)
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/django/db/models/sql/compiler.py", line 912, in execute_sql cursor.execute(sql, params)
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/django/db/backends/mysql/base.py", line 114, in execute return self.cursor.execute(query, args)
File "/data/addons-stage/www/addons.allizom.org/current/venv/lib/python2.6/site-packages/newrelic-2.4.0.4/newrelic/hooks/database_dbapi2.py", line 34, in execute return self._nr_cursor.execute(sql, *args, **kwargs)
File "/usr/lib64/python2.6/site-packages/MySQLdb/cursors.py", line 173, in execute self.errorhandler(self, exc, value)
File "/usr/lib64/python2.6/site-packages/MySQLdb/connections.py", line 36, in defaulterrorhandler raise errorclass, errorvalue
DatabaseError: (1406, "Data too long for column 'author' at row 1")

Comment 2

[krupa raj[:krupa]]

Note that using a regular username causes a successful theme submission.

Comment 3

[Kris Maglione [:kmag]]

The `personas` table limits usernames to 32 characters. The `users` table limits it to 255.

Let's just drop the `author` and `display_username` column from the `personas` table and use the actual user display name everywhere instead.