Old bug in RT-Extension-MergeUsers sometimes prevents user creation


I’ve just spent several hours tracking down why when a new user should be created automatically by visiting our RT’s SelfService (before they had created any tickets) it always failed with the message “User could not be created: Email address in use”.

I eventually tracked it down to what I’d call a bug in RT-Extension-MergeUsers caused by its version of CanonicalizeEmailAddress(). The new user being created doesn’t have an email address and if you have any other users in your database with no email address the canonicalization will choose one of them (the first?) to replace the new users (non-existent) email address with. And that results in the “Email address in use” we are seeing…

After figuring all this out I thought I’d report it as a bug and so went to the RT-Extension-MergeUsers CPAN site to do that. And I found that exactly this issue had already been reported back in June 2016 - see Bug #115494 for RT-Extension-MergeUsers: Empty email addresses must not be canonicalized. That bug was reported against version 1.02_01 but the current version (1.06) doesn’t appear to have been fixed.

If anyone responsible for that extension reads this forum it would be great to have the bug fixed to avoid the need for a local patch.

Alternatively the bug could be addressed in the RT core. The call to CanonicalizeEmailAddress() in User::Create() (line 147 in RT 5.0.2) could be made conditional on $args{‘EmailAddress’} being set. Is there any reason why you’d want to canonicalize an empty address?