deleted or merged persons/teams can have memberships left over which cannot be revoked
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Launchpad itself |
Fix Released
|
Critical
|
Curtis Hovey |
Bug Description
Symptoms
========
Delete user foo (or team foo). Someone else adds foo to a team at the same time. After the delete the user or team will still be in the new team (sometimes).
A 403 will be raised if the merged team was private. Even if the team was deactivated,
the +members page can not be viewed by team admins because no one has permission to
view the merged team.
Diagnosis
=========
When person foo is deleted / merged a job executes to remove all the teams / memberships. This is naturally racey - unless it is delayed longer than the longest possible web transaction, it will not see all newly added memberships, and there are nothing causing contention on common rows, so neither transaction will fail.
The current situation is that we run the update job after most transactions so new occurrences of this should be fairly rare (but short of an audit, not impossible).
Possible solutions
==================
* Run a garbo job looking for memberships of deleted person/teams.
* Ensure that the purge process runs after *all* possible transactions adding membership (and team participation) rows... web ops, scripts, backend jobs.
A garbo job will have progressively slower performance but is simple to implement.
Related branches
- Richard Harding (community): Approve
-
Diff: 97 lines (+42/-0)3 files modifieddatabase/schema/security.cfg (+1/-0)
lib/lp/scripts/garbo.py (+20/-0)
lib/lp/scripts/tests/test_garbo.py (+21/-0)
Changed in launchpad-registry: | |
importance: | Undecided → Low |
status: | New → Triaged |
tags: | added: canonical-losa-lp |
tags: | added: merge-deactivate |
description: | updated |
Changed in launchpad: | |
status: | Triaged → In Progress |
tags: |
added: qa-ok removed: qa-needstesting |
Changed in launchpad: | |
status: | Fix Committed → Fix Released |
This currently breaks a script I need to get the loco-directory rolling. :-)