Gift Exchange: Simultaneously updating the Giver and Write-in Giver for a Potential Assignment breaks anonymity by causing the Giver's name to appear on the Write-In Giver's My Assignments page


Steps to reproduce

  1. Log in

  2. Create a collection with a gift exchange challenge

    1. Browse > Collections > New Collection

    2. Fill in required information and choose "Gift Exchange" for "Type of challenge, if any"

    3. Submit

    4. On the exchange settings form, check "Sign-up open?"

    5. Submit

  3. Sign up for the exchange as three different users (it’s easiest if one of them is the collection owner)

    1. Follow the "Sign-up Form" link in the collection sidebar

    2. Since we accepted the default settings, we don't even need to fill anything in – just press "Submit"

  4. If you're not already logged in as the collection owner, log back in with that account

  5. Run matching

    1. On your collection's sidebar, follow the "Challenge Settings" link

    2. Uncheck "Sign-up open?"

    3. Press "Update"

    4. From the sidebar, follow the "Matching" link

    5. Press "Generate Potential Matches"

    6. You'll get a pop-up warning you matches will be random; choose "OK"

    7. Wait briefly for matching to finish and refresh the page to see potential matches

  6. Copy each name from the Giver field into the Write-In Giver field in the next column, making sure to write it in the format pseud (username), e.g. the user testy2 should be written testy2 (testy2) (I’m not actually 100% sure if will apply to this field as well, but better safe than sorry when it takes this many steps to reproduce a bug)

  7. Use the red × to clear each Giver

  8. Replace the original Giver with the other collection participant who is neither the Write-In Giver nor the Recipient, again making sure to write it in the format pseud (username) due to , e.g. the user testy2 should be written testy2 (testy2)

  9. Press “Save Assignment Changes”

  10. Press “Send Assignments”

What happens

When a participant follows the "My Assignments" link on the collection dashboard, they will find two assignments: theirs and someone else's.

The someone else's is actually their pinch-hit, but it displays the actual assignee's name.

What should happen

It should display "their_name* (pinch hitter)".


While just fixing the name that displays is an okay fix for now, the problem is deeper.

When the challenge moderator fills in both the Giver and Write-In Giver fields as described, the ChallengeAssignment objects all end up with both an offer_signup_id and a pinch_hitter_id.

This means that if the Write-In Giver (pinch-hitter) goes to fill the assignment, the assignment does not get marked as fulfilled on their assignments page (or, indeed, on the moderator’s view of assignments).

Usually, when a mod assigns a pinch-hitter through other means, a brand new ChallengeAssignment is created with a pinch_hitter_id (rather than adding a pinch_hitter_id to the existing ChallengeAssignment).

Ideally, we should fix this issue with the ChallengeAssignment, but in the meantime, we should at least make sure the write-in giver (pinch-hitter) doesn’t see the actual assignee’s name (and email due to AO3-5733).












Affects versions

Fix versions






Required Access Level



Internal 0.9