Re: Handling registraion errors/raise soft errors in detectors

On Fri, Jul 31, 2020 at 11:13:32PM -0400, John P. Rouillard wrote:
> 
> In the BPO tracker the user registration (user.register.html page)
> asked for the homepage url during registration. There is no validation
> of the registration request at the time of registration. Also BPO
> sends a verification email to the user before acting on the
> registration.
> 
> If the user put in a bad homepage url, the registration process failed
> with a Reject error and the new user was not created.
> 
> Granted this is a bit of a niche operation because the registration
> process is less interactive than editing the user item.
> 
> There are two ways to deal with this:
> 
>   1) validate the registration request
>   2) allow auditors to return soft errors so the user is notified that
>      something failed the audit. But the user is still created.

Hmm, I'd vote for 1), seems dealing with invalid data later produces a
lot of effort.
The other variant with an auditor that changes the URL to something with
prefix 'INVALID' seems the second-best choice to me.
There is also the security-problem of giving users the choice of
inserting arbitrary urls. These should at least be marked 'nofollow'
when rendering.

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]