Warn before silently attributing every author to the importing admin on account-less exports #561

New issue

Open

opened 2026-07-19 07:16:59 +00:00 by tobi · 0 comments

tobi commented

2026-07-19 07:16:59 +00:00

Owner

Found while running the real-MariaDB verification pass for the site/account importer rewrite (#557-#560).

Importer.makeAccountResolver (code/Global/Importer.js around line 257-278) resolves each old creator id against accountMap, built from the export's accounts.json. When an export has no accounts.json at all — true for every export produced before the cross-instance account-resolution work landed — accountMap is empty, so every single lookup falls through to the final else branch and returns fallbackUser (the admin performing the import), not a placeholder:

} else {
  resolved = fallbackUser;
}

This is arguably the only thing the code can do in that case — there's no name data at all to label a placeholder with, since accounts.json is what carries id -> name. But it means every distinct original author's stories/comments/etc. get silently collapsed onto whoever runs the import.

Worse, this is invisible at review time. Importer.preview's report only lists rows that exist in accountMap, so when the map is empty there's nothing to show — no "unresolved" table, no count, nothing distinguishing this from a completely clean import. Compare with a tampered/foreign-machine export (accounts.json present but non-matching), which correctly shows "0 authors matched automatically" plus a per-account "No matching account found" row with an override field.

Verified via a live test on antville-test.de: exported a fixture site, then re-uploaded a copy with accounts.json removed and exportKey stripped from index.json. Preview showed only "0 authors matched automatically" with no unresolved-accounts table at all. After confirming, every story and comment (originally attributed to a distinct test account) ended up attributed to the importing admin account instead, with no error or warning anywhere in the flow.

Suggested fix: when accountMap is empty (or when Importer.preview detects the export predates accounts.json, e.g. index.json has no exportKey), surface an explicit warning in the review screen — something like "This export has no author data; all content will be attributed to your account" — so the admin makes an informed choice instead of this happening silently.

Found while running the real-MariaDB verification pass for the site/account importer rewrite (#557-#560). `Importer.makeAccountResolver` (`code/Global/Importer.js` around line 257-278) resolves each old creator id against `accountMap`, built from the export's `accounts.json`. When an export has no `accounts.json` at all — true for every export produced before the cross-instance account-resolution work landed — `accountMap` is empty, so every single lookup falls through to the final `else` branch and returns `fallbackUser` (the admin performing the import), not a placeholder: ```js } else { resolved = fallbackUser; } ``` This is arguably the only thing the code *can* do in that case — there's no name data at all to label a placeholder with, since `accounts.json` is what carries `id -> name`. But it means every distinct original author's stories/comments/etc. get silently collapsed onto whoever runs the import. Worse, this is invisible at review time. `Importer.preview`'s report only lists rows that exist in `accountMap`, so when the map is empty there's nothing to show — no "unresolved" table, no count, nothing distinguishing this from a completely clean import. Compare with a tampered/foreign-machine export (accounts.json present but non-matching), which correctly shows "0 authors matched automatically" plus a per-account "No matching account found" row with an override field. Verified via a live test on antville-test.de: exported a fixture site, then re-uploaded a copy with `accounts.json` removed and `exportKey` stripped from `index.json`. Preview showed only "0 authors matched automatically" with no unresolved-accounts table at all. After confirming, every story and comment (originally attributed to a distinct test account) ended up attributed to the importing admin account instead, with no error or warning anywhere in the flow. **Suggested fix:** when `accountMap` is empty (or when `Importer.preview` detects the export predates `accounts.json`, e.g. `index.json` has no `exportKey`), surface an explicit warning in the review screen — something like "This export has no author data; all content will be attributed to your account" — so the admin makes an informed choice instead of this happening silently.

tobi self-assigned this

2026-07-19 07:17:05 +00:00