Uninstallation of modules from "res.config.settings" is dangerous

Bug #1262172 reported by Guewen Baconnier @ Camptocamp
28
This bug affects 6 people
Affects Status Importance Assigned to Milestone
Odoo Server (MOVED TO GITHUB)
Confirmed
Wishlist
OpenERP's Framework R&D

Bug Description

In "Settings > Configuration" we have various section "Sales", "Purchases" and so on. In each section, we can find configuration options, usually checkboxes. Some of them change groups, some install modules.

Example:
"Settings > Configuration > General Settings" : The option "Activate the customer portal" installs the portal module.

And the reverse, when the checkbox is ticked and we untick it, the portal module is uninstalled.

This is very dangerous when people do not really realize what is happening underhand, especially since the columns of the uninstalled modules are dropped. But this is even more dangerous: the uninstallation also uninstalls all the dependencies and there is no warning (when we uninstall a module from the "Installed Modules" menu, there is a warning).

It can lead to serious damage on a database, when a user thinks is just activating / deactivating options.

description: updated
Revision history for this message
Twinkle Christian(OpenERP) (tch-openerp) wrote :

Hello,

Considering as a improvement. So, marking it as 'wishlist'.

Thanks.

Changed in openobject-server:
assignee: nobody → OpenERP's Framework R&D (openerp-dev-framework)
importance: Undecided → Wishlist
status: New → Confirmed
Revision history for this message
Yannick Vaucher @ Camptocamp (yvaucher-c2c) wrote :

As it can be related to this one:

https://bugs.launchpad.net/openobject-server/+bug/1262150

This can cause serious issue as the user has no idea he is doing something dangerous.
One click to kill a DB seems a quite reasonable reason to take it seriously.

Revision history for this message
Nicolas Bessi - Camptocamp (nbessi-c2c-deactivatedaccount) wrote :

Hello,

There is no way this can be a whishlist this bug can ruin a production environment (On SAAS too.).
At least once ticked the check box should become invisible when it uninstall an addon or raises a STRONG warning.
It is as serious as a security bug.

Regards

Nicolas

Revision history for this message
Alexandre Fayolle - camptocamp (alexandre-fayolle-c2c) wrote :

which modules depend on portal ?

Revision history for this message
Nhomar - Vauxoo (nhomar) wrote :

+1.

It is a bug.

And the help is really weak, it should inform explicitily what will happend.

IMHO:

Solution options:

1.- Warning + Fix the fact of the uninstall delete data.
2.- Only Warning.

Revision history for this message
Raphaël Valyi - http://www.akretion.com (rvalyi) wrote :

Hello,

just a complementary note: I think this is even really bad that clicking on a checkbox can install a module without further warning. In a low support prospective (SaaS and co), a user would easily click on all possible settings just to try. That will silently install modules that will not be easy to uninstall, that may corrupt the database or even just make the implementation a lot more complex than it should be.

With a setting checkbox, user simply expects the action will be benign an reversible easily. That is not the case as this can lead to a half day of expert support eventually that user would eventually be unable/unwilling to pay for. So please change that and issue a proper warning both at module installation and un-installation.

Thanks.

Revision history for this message
Antony Lesuisse (OpenERP) (al-openerp) wrote :

We would like to add the warning when unchecking a checkbox will trigger a module uninstall.
Please help us with a nice MP.

Revision history for this message
Raphaël Valyi - http://www.akretion.com (rvalyi) wrote : Re: [Bug 1262172] Re: Uninstallation of modules from "res.config.settings" is dangerous

Hello Antony,

I think that won't be a problem to do a MP for that.
But what about doing that also at module installation? Like "you should be
aware that action will install module X, will alter the database schema and
the ERP processes. Also uninstalling this module later may require expert
assistance. Ideally you already validated you need this module on a test
database first."
Eventually such a warning could trigger or not according to module
complexity or to another flag.

For me it looks a bit inconsistent that you let the user possibly screw his
installation silently at module installation and you warn him he his
potentially screwed only once he tries to uninstall the module and it's too
late.

On Mon, Dec 23, 2013 at 9:08 AM, Antony Lesuisse (OpenERP)
<email address hidden>wrote:

> We would like to add the warning when unchecking a checkbox will trigger a
> module uninstall.
> Please help us with a nice MP.
>
> --
> You received this bug notification because you are subscribed to OpenERP
> Server.
> https://bugs.launchpad.net/bugs/1262172
>
> Title:
> Uninstallation of modules from "res.config.settings" is dangerous
>
> Status in OpenERP Server:
> Confirmed
>
> Bug description:
> In "Settings > Configuration" we have various section "Sales",
> "Purchases" and so on. In each section, we can find configuration
> options, usually checkboxes. Some of them change groups, some install
> modules.
>
> Example:
> "Settings > Configuration > General Settings" : The option "Activate the
> customer portal" installs the portal module.
>
> And the reverse, when the checkbox is ticked and we untick it, the
> portal module is uninstalled.
>
> This is very dangerous when people do not really realize what is
> happening underhand, especially since the columns of the uninstalled
> modules are dropped. But this is even more dangerous: the
> uninstallation also uninstalls all the dependencies and there is no
> warning (when we uninstall a module from the "Installed Modules" menu,
> there is a warning).
>
> It can lead to serious damage on a database, when a user thinks is
> just activating / deactivating options.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/openobject-server/+bug/1262172/+subscriptions
>

Revision history for this message
Alexandre Fayolle - camptocamp (alexandre-fayolle-c2c) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.