MySQL Bugs: #35016: Database error on wiki

Bug #35016	Database error on wiki
Submitted:	3 Mar 2008 21:35	Modified:	13 Mar 2014 7:59
Reporter:	Diego Medina	Email Updates:
Status:	Won't fix	Impact on me:	None
Category:	MySQL Websites: MySQLForge	Severity:	S3 (Non-critical)
Version:	forge1.mysql.com	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
clicking on link gives Database error

How to repeat:
go here
http://forge1.mysql.com/contribute/cla.php
then click on FAQ link from within the Contribute section
the link is http://forge1.mysql.com/wiki/ContributingFAQ
and you will see the error

the whole wiki is not working
http://forge1.mysql.com/wiki/

Hi Diego!

I cannot repeat this.  If the error is the "duplicate key" error, it is likely that in testing so much (and me fixing stuff as I could), your cookies and auth stuff got trashed.  Could you go ahead and clear all cookies, and try the link both as a logged in and anonymous user?

thanks much!

-jay

Just verified the wiki to be working. Maybe it was some temporary downtime. Expect more of that, when it gets an upgrade.

with no cookies I do not get an error, but after I login, I get the error again, and the complete error is:

A database query syntax error has occurred. This may indicate a bug in the software. The last attempted database query was:

    (SQL query hidden)

from within function "User::addToDatabase". MySQL returned error "1062: Duplicate entry 'diego@fmpwizard.com' for key 3 (localhost)".

would that mean that I need to create a new account to keep testing?

Diego, did you clear all cookies and login?

I think everything got messed up internally because of other authentication bugs that you found.  I reset your user_name internally for both the wiki and forge to diego2.  Please try again after clearing your cookies.

Thanks!

Hi Jay,

In short, I still get the same error.

now some details:

1- I am using firefox under fedora 8
2- To make really sure no cookies are present I started firefox using a brand new profile and used the option "clear pricate data" (and marking all options)
3- Went to the wiki on forge1.mysql.com and the page worked normal (as I was not logged in)
4- Click login, and as the login page redirects me, there you are, the error again.
5- The account I used was the one where my email address is diego@ (the domain of my site)
If I try to log in using the email address of mysql@ (the domain of my site) it does not give error nor logs me in.

Let me know if you would need more information

Regards,

I am not able to repeat this issue.

OK, thanks much for the detailed info, Diego.  I'm going to take a dump of the DB on forge1, load up my local environment and log in with you using my XDebug tracing utility, to see what's going on.  Could you email me at jay at mysql dot com with your password for both accounts so I can test locally?  Again, thanks much!

-jay

This is what I did now, I created a new account, logged in and went to the wiki and now everything works normal.

Then I logged off, logged in with my old account and the wiki worked again, so no bug

Jay, I did not see your last comment here asking me for my password, sorry.

But I just found out how to replicate it.

(Right now you cannot edit your profiles on the forge1.mysql.com) but you can create a new one and do this steps:

on "Display name" enter  ">your_name

(note the open quote and greater than character)

and then continue to fill in the rest of the data.

Then go to the wiki section and now you will see the error.

I know that this error only shows to the user who decides to have those characters on the display name, but you may want to make sure no sql injection can be done using a similar method.

-
Diego

Hi Diego,

I am marking this as to be fixed later.  No SQL injection or XSS is possible -- I tested it.  However, the problem does indeed happen for users who begin their display names with weird characters.  It's a MediaWiki issue in how it "munges" the user name compared with the main forge system...

Anyway, I will note it as a known bug for now.  Thanks.

-jay

MySQL Forge has been discontinued.