friend request issues (with two similar accounts)

[Kristina Hoeppner]

Charlie and I had a bit of trouble with friend requests on master.dev.

Here's the timeline of the events:

1. Charlie sends friend request to Kristina (member of Mahoodle).
2. Kristina accepts friend request and leaves browser window (FF 3.6 on Mac 10.6) open (and sends a wall message to Charlie as well)
3. Charlie sends friend request to Kristina DC (admin on master.dev)
4. real Kristina clicks on link in email and sees the friend request in Mahara BUT while still logged in as Kristina (and not Kristina DC). It says "1 pending friend" there despite it being the request for Kristina DC
5. Kristina tries to approve friend request but gets error message: "Mahara: Master Branch: Site unavailable. A nonrecoverable error occured. This probably means you have encountered a bug in the system."
6. Kristina tries to deny friend request and succeeds.
7. Charlie receives friend denial from Kristina, but is still friends with Kristina on master.dev as that was the denial for the friend request for Kristina DC
8. real Kristina logs into Mahara as Kristina DC and sees friend request from Charlie
9. Kristina DC can accept friend request without problems

[Richard Mansfield (richard-mansfield)]

I had a look at the log -- it looks like the error occurred when trying to accept a friend request from a user you were already friends with. We should detect this case and maybe just reload the page, or do something less ugly than the site unavailable message.

[Kristina Hoeppner (kris-hoeppner)]

The link had not detected that I actually needed to log in as a different user. If we say that this is not possible, then it is still a bit strange that I could deny the friend request, but still have Charlie show up as one of my friends afterward.

[Andrew Nicols (dobedobedoh)]

Having real trouble actually replicating this bug - the link in the e-mail only takes you to the profile page, and since friendship has already been established, I don't see the 1 Pending friend request.

Alpha - Chrome
Bravo - Firefox
Charlie - Not logged in

Alpha Requests friendship with Bravo
Bravo accepts friendship with Alpha
Bravo writes on Alpha's wall
Alpha requests friendship with Charlie
Bravo clicks on link in Charlie's e-mail (http://mahara.local/user/view.php?id=3)
--- No pending user request

As a result, I can't reproduce the rest of the bug either.

However, a potential fix could be:
get_record_sql from usr_friend matching the two users
-> if match found, delete any pending requests for between these users and redirect as normal adding the normal OK message (or alternatively telling them that they're already friends).
-> match not found - continue

[Kristina Hoeppner (kris-hoeppner)]

I could not reproduce the error today when I created a new user and went through the steps I had detailed above.

"Bravo clicks on link in Charlie's e-mail (http://mahara.local/user/view.php?id=3)" -> For me this is still: Charlie clicks on link in Alpha's mail and get's taken to Alpha's profile page being logged in as Bravo. New (and better) though is that Bravo can only remove Alpha from his friends.

Were it possible to verify that the correct user is actually logged in when a friend request is sent and the user clicks on the link. Though it may not occur too often that people have multiple accounts.

[Richard Mansfield (richard-mansfield)]

I expect it's possible to force the user to log out and another to log in by adding a userid to the link. But probably not worth rushing to fix this for 1.3 - it's been present in every version of Mahara so far and only caused mild annoyance to the testers & developers who log in with multiple identities!

[Kristina Hoeppner (kris-hoeppner)]

I agree. It's not an urgent matter.

[Robert Lyon (robertl-9)]

Is this still an issue? I couldn't immediately tell from initial tests.

[Kristina Hoeppner (kris-hoeppner)]

Since I wasn't able to replicate the issue in 2010 and haven't seen it since, I would say that we should close it. SInce then when I tried to go to a page of which I wasn't an owner, I could see it if I had permissions to do so or not if I didn't have the appropriate permissions. If it occurs again, I'll file a new bug.