1361158 - Scheduled change emails should not include csrf_token in 'Row to be inserted'

Status: RESOLVED DUPLICATE of bug 1336452

(Release Engineering Graveyard :: Applications: Balrog (backend), defect, P1)

Description

[Nick Thomas [:nthomas] (UTC+12)]

Received this today:

Changed by: [e-mail]
Row to be inserted:
{'base_alias': None,
 'base_backgroundRate': 50,
 'base_buildID': None,
 'base_buildTarget': None,
 'base_channel': 'release',
 'base_comment': 'Update subset of users who are running 52.x to 52.<latest>',
 'base_data_version': 7,
 'base_distVersion': None,
 'base_distribution': None,
 'base_fallbackMapping': None,
 'base_headerArchitecture': None,
 'base_locale': None,
 'base_mapping': 'Thunderbird-52.1.0-build2',
 'base_osVersion': None,
 'base_priority': 86,
 'base_product': 'Thunderbird',
 'base_rule_id': 571,
 'base_systemCapabilities': None,
 'base_update_type': 'minor',
 'base_version': '>=52.0',
 'base_whitelist': None,
 'change_type': 'update',
 'csrf_token': '<redacted>',                 <------- this should be removed
 'data_version': 1,
 'scheduled_by': '[e-mail]'}

Comment 1

[[e-mail] (:bhearsum)]

This is probably a by-product of grabbing all the form fields and just passing them to the database layer, eg: https://github.com/mozilla/balrog/blob/master/auslib/web/admin/views/scheduled_changes.py#L72

This should probably be fixed at the web layer.

Comment 2

[Nick Thomas [:nthomas] (UTC+12)]

Have also seen this in a new rule notification which wasn't a scheduled change.

Comment 3

[[e-mail] (:bhearsum)]

(In reply to Nick Thomas [:nthomas] from comment #2)
> Have also seen this in a new rule notification which wasn't a scheduled
> change.

I also saw one recently that had "_duplicate" in the data. I think this might be fixed by Ashish's swagger work...

Comment 4

[Harkishen H [:harikishenh]]

I would like to work on this bug.

Comment 5

[[e-mail] (:bhearsum)]

(In reply to Harkishen H [:harikishenh] from comment #4)
> I would like to work on this bug.

This probably isn't a good choice for the moment, I think it's going to be fixed as a side effect of https://bugzilla.mozilla.org/show_bug.cgi?id=1336452.

Comment 6

[Harkishen H [:harikishenh]]

oh....can you suggest any other backend bug i can work on ???