305979 - Removing a user account who was requested to set a flag at least once may return wrong information

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[Frédéric Buclin]

editusers.cgi, action eq "del":

    $vars->{'flags'}{'requestee'} = $dbh->selectrow_array(
        'SELECT COUNT(*) FROM flags WHERE requestee_id = ?',
        undef, $otherUserID);

Inactive flags should not be included. When deleting a user account, the UI may
complain that this user is requested for some flags but following the URL may
give you an empty list, which is very confusing. I had to manually ask the DB to
find the problem.

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

We don't hide the truth, but I think it's better to ignore inactive flags than
giving URLs inconsistent with what the message says.

Inactive flags whose setter is the user we want to delete is another story. I
would tend to ignore them too, but as these flags are not deleted and the
setter remains unchanged, we would end in a referential integrity and the admin
must be aware of that. Oh dear...

Comment 2

[Marc Schumann [:Wurblzap]]

Is the problem here that I cannot search for inactive flags? Is this the reason
that following the URL may result in an empty list?

Comment 3

[Frédéric Buclin]

Yes, the URL will show you active flags only (as expected), so inactive ones
shouldn't be included in the count.

Comment 4

[Marc Schumann [:Wurblzap]]

Comment on attachment 193861 [details] [diff] [review]
patch, v1

Tested; works.

I can't think of a szenario to make something like bug 223878 happen. Even if,
then it's not caused by this patch here but by user deletion itself.

Comment 5

[Frédéric Buclin]

tip:

Checking in editusers.cgi;
/cvsroot/mozilla/webtools/bugzilla/editusers.cgi,v  <--  editusers.cgi
new revision: 1.106; previous revision: 1.105
done


2.20:

Checking in editusers.cgi;
/cvsroot/mozilla/webtools/bugzilla/editusers.cgi,v  <--  editusers.cgi
new revision: 1.90.2.7; previous revision: 1.90.2.6
done