removed computer still able to upload files

[Steven]

If a computer with a running client is removed from the web interface the client remains logged in and is able to download and upload new files.

It might make sense to disconnect clients running on removed computers or otherwise deny file operations.

[Joshua Hoover (joshuahoover)]

Thank you for the bug report Steven. I'm tagging this so that it gets looked into by the appropriate team. I think your expectation that removing a computer from your account via the web ui should no longer allow the client to continue to have access is probably the one most users would have.

[Matt Griffin (mattgriffin)]

If you restart the computer, will download/upload be disabled on the computer?

[Steven (steven3000)]

Yes, I just restarted Ubuntu ONE after removing my computer from the web interface and it does not connects anymore as expected.

[Elliot Murphy (statik)]

the next time the computer reconnects, the connection will be refused,
it's just that a computer might be connected for a couple hours or
days before the next reconnect. this problem should be handled when we
start doing smarter autokick/loadbal stuff.

--
Elliot Murphy

On Aug 8, 2009, at 5:31 PM, Matt Griffin <email address hidden>
wrote:

> If you restart the computer, will download/upload be disabled on the
> computer?
>
> --
> removed computer still able to upload files
> https://bugs.launchpad.net/bugs/396633
> You received this bug notification because you are a member of Ubuntu
> One hackers, which is subscribed to Ubunet.
>
> Status in Ubunet: Triaged
>
> Bug description:
> If a computer with a running client is removed from the web
> interface the client remains logged in and is able to download and
> upload new files.
>
> It might make sense to disconnect clients running on removed
> computers or otherwise deny file operations.
>

[Joshua Hoover (joshuahoover)]

I added the following FAQ until we force a disconnect from the server side: https://answers.edge.launchpad.net/ubuntuone-client/+faq/899

[John O'Brien (jdobrien)]

Option 1: The simple fix would be to save the oauth token used for the connection and verify it on every request (or occasionally). But this would introduce some overhead in db calls. This overhead may be reduced if we memcached the oauth tokens.

Option 2: Similar to option 1: Memcache the session_ids with the related oauth token and check the sessionid on every request. When the token is removed, delete the session id associated with the token.

Option 3: Send out notifications when tokens are deleted, however there is no infrastructure to do at this time. We would also need to save the oauth token in each connection on the server and then delete it when the notification was received.