pretalx / pretalx

Conference planning tool: CfP, scheduling, speaker management
https://pretalx.com
Apache License 2.0
710 stars 200 forks source link

adding a speaker whose email local part is a existing nickname crashes #70

Closed luto closed 7 years ago

luto commented 7 years ago

On /orga/event/foo/submissions/1/speakers: When you add a speaker, whose email local part (admin@google.com => admin) is already present in the database as a nickname, the app crashes.

# POST['nick'] is either a nickname or email, as per UI
try:
    # look for nicknames matching the given value
    speaker = User.objects.get(nick__iexact=request.POST.get('nick'))
except User.DoesNotExist:
    # in case the speaker can't be found, create a new one and invite them (see below)
    speaker = create_user_as_orga(request.POST.get('nick'), submission=submission)

Up until now, everything is fine. create_user_as_orga now tries to create a new user...

# (...)
user = User.objects.create_user(
    # ... and utilizes the local part of the email as a nickname => crash.
    nick=email.split('@')[0].lower(),
    # (...)
)
# (...)

So, given a user admin exists and the orga member tries to add admin@google.com as a speaker, pretalx checks if a user nicknamed admin@google.com exists, finds there is none and then proceeds to create a new user called admin which causes a crash.

rixx commented 7 years ago

Yyyup, I introduced that bug about two days ago when building the feature in a slightly rushed manner.

What's even worse (and easier to fix) – if you try and add a user with an already registered email address, it tries to re-add them and crashes, too. Yeah.

These are the steps that need to be taken to close this issue, in my opinion:

  1. Check if the given handle is an email address – if so, look the user up, and use the already registered user if possible.
  2. Try to create the user – if the nick is already taken, try adding a semi-random suffix to the nickname. Possible suffixes should include _, 123, _speaker, _the_third and whatever catches your fancy.