REST API delete user function does not delete every 2nd linked address
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
GNU Mailman |
Fix Released
|
High
|
Barry Warsaw |
Bug Description
The following series of curl commands creates a user with an email address of ‘<email address hidden>’, and then links 10 additional addresses to <email address hidden>
curl -X POST --data "<email address hidden>
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
curl -X POST --data "<email address hidden>" --header "authorization: Basic cmVzdGFkbWluOnJ
A sqlite3 dump of the database shows the following in the addresses table:
INSERT INTO "address" VALUES(11,'<email address hidden>
INSERT INTO "address" VALUES(12,'<email address hidden>
INSERT INTO "address" VALUES(13,'<email address hidden>
INSERT INTO "address" VALUES(14,'<email address hidden>
INSERT INTO "address" VALUES(15,'<email address hidden>
INSERT INTO "address" VALUES(16,'<email address hidden>
INSERT INTO "address" VALUES(17,'<email address hidden>
INSERT INTO "address" VALUES(18,'<email address hidden>
INSERT INTO "address" VALUES(19,'<email address hidden>
INSERT INTO "address" VALUES(20,'<email address hidden>
INSERT INTO "address" VALUES(21,'<email address hidden>
All good at this stage. No problems.
The following curl command deletes user ‘<email address hidden>’
curl --verbose -X DELETE --header "authorization: Basic cmVzdGFkbWluOnJ
Strangely, a sqlite3 dump of the database now shows the following in the addresses table:
INSERT INTO "address" VALUES(12,'<email address hidden>
INSERT INTO "address" VALUES(14,'<email address hidden>
INSERT INTO "address" VALUES(16,'<email address hidden>
INSERT INTO "address" VALUES(18,'<email address hidden>
INSERT INTO "address" VALUES(20,'<email address hidden>
So 6 of the addresses that should have been deleted were deleted, but 5 remain. The linked address deletion seems to be skipping addresses for some reason.
It appears the problem is caused by the delete address functionality mutating the iterator of user addresses.
This appears to fix the problem, which is in rest/users.py
def on_delete(self, request, response):
"""Delete the named user, all her memberships, and addresses."""
if self._user is None:
return
for member in self._user.
for address in self._user.
# to avoid mutating the self._user.
for address in addresses_
tags: | added: mailman3 |
Changed in mailman: | |
milestone: | none → 3.0.0b6 |
assignee: | nobody → Barry Warsaw (barry) |
importance: | Undecided → High |
status: | New → In Progress |
Changed in mailman: | |
status: | In Progress → Fix Committed |
Changed in mailman: | |
status: | Fix Committed → Fix Released |