"after commit" user trigger search expression wrong

[drn05r]

The trigger to find eprint records that need updated when a user connects/disconnects is wrong as it will match parts of the creators ID (e.g. email address) and not the whole ID. This is a big problem if email addresses are used as creators ID as many may be for the same domain, so any eprint with a creators ID wthe an email address on the same domain will match. In fact they may even match on the parts of the domain (e.g. 'edu').

orcid_support_advance/cfg/cfg.d/z_orcid_support_advance.pl

Lines 461 to 464 in dd18186

	$search_exp->add_field(
	fields => [ $ds->field( $role.'_id' ) ],
	value => $email,
	);

The search expression should use EX so it only matches exactly:

$search_exp->add_field(
    fields => [ $ds->field( 'creators_id' ) ],
    value => $email,
    match => 'EX',
);

[photomedia]

Wow, this bug is still not fixed? It seems like a major issue, no? Also, would the "EX" option make it a case-sensitive search? Because I don't think we want that, I think we want case insensitive.

[wfyson]

This tends not to be an issue (I've certainly never had it reported to me from anyone, and I can't reproduce it either) as the default matching option when one isn't specified is EQ, which EPrints describes as "Treat the value as a single string. Match only fields which have this value." So I think we're all good!

And I've just checked to see if it's case sensitive and it isn't so hopefully that meets your needs too!

[photomedia]

Thank you @wfyson . I thought also that if this was a real bug, then it would be serious enough that we would have seen reports of it. @drn05r , can you please review this info, as you submitted the bug, and close it if you confirm that this is not an issue?

[photomedia]

I just found one example of a user/depositor overwriting the author info of not their own item, right after connecting their ORCID. This could very well be an example of this issue. User A connects their ORCID at time T1, at the same time, User A modifies the deposit of User B by changing their creator name to null. The result is that another deposits creator name is removed from the deposit! User A and User B both have @gmail.com addresses in their profiles.