652875 - Copying of an addon results in broken Session Cookie if action done just after login

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Add-on Builder, defect, P3)

Description

[Ayan Shah[:ashah]]

Currently, we can only create a single copy of an add-on. But, this behavior should be duplicated and users should be allowed to create multiple copies of an add-on.

Comment 1

[Piotr Zalewa [:zalun]]

https://github.com/zalun/FlightDeck/commit/035c76ef4c31c191c230adda93f52b66d52baeba

Comment 2

[Piotr Zalewa [:zalun]]

Name convention change

https://github.com/zalun/FlightDeck/commit/8b413e2fbc97af857729737ac76925019b5a420b

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Reopening; failing due to CSRF check 403'ing:

[11:02:04.835] GET https://builder-addons.allizom.org/module/1377/ [HTTP/1.1 200 OK 53ms]
[11:02:05.004] GET https://builder-addons.allizom.org/addon/1000219/latest/worker-javascript.js [HTTP/1.1 304 NOT MODIFIED 398ms]
[11:02:06.280] GET https://builder-addons.allizom.org/get_latest_revision_number/1000219/ [HTTP/1.1 200 OK 18ms]
[11:02:06.354] POST https://builder-addons.allizom.org/addon/copy/1000219/revision/96/ [HTTP/1.1 403 FORBIDDEN 3029ms]

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Screenshot showing CSRF failure during copy

Comment 5

[Piotr Zalewa [:zalun]]

Looks like it works for me - is this fixed already?

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #5)
> Looks like it works for me - is this fixed already?

No, can still reproduce; are you testing in prod, or staging?

Comment 7

[Piotr Zalewa [:zalun]]

I checked in prod and trunk (as your screenshot was from trunk)

Comment 8

[Sean McArthur [:seanmonstar]]

I am unable to reproduce as well. Anything else that might be different?

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #8)
> I am unable to reproduce as well. Anything else that might be different?

Sorry, not that I can think of; here's a screencast showing the issue from start to finish: http://screencast.com/t/yQB2WPUZoNGf

Comment 10

[Piotr Zalewa [:zalun]]

I am able to reproduce now - one has to start logged out

Comment 11

[Piotr Zalewa [:zalun]]

Looks like the csrftoken is wrong. 
It is reset when creating another Package.
From that moment one may copy any add-on

Comment 12

[Piotr Zalewa [:zalun]]

The reproduce steps from screencast don't always work. After I came through the process of changing the csrftoken in cookies, I was able to replicate the steps without reproducing the bug

Comment 14

[Piotr Zalewa [:zalun]]

I will code in a workaround - do not display [Copy] link if not logged in

Comment 15

[Piotr Zalewa [:zalun]]

In review https://github.com/zalun/FlightDeck/commit/cb1a58b7eb13309e33d8f0fc3b8ca6292c3340a4

Comment 17

[Piotr Zalewa [:zalun]]

Marking as fixed, browserId should solve this issue and anonymous copying will become possible again

Comment 18

[Zac C (:zac)]

Copy can't be done if not logged in now so the workflow is no longer valid.

Will need to re-test for this bug if we re-enable anonymous copying

Comment 20

[Piotr Zalewa [:zalun]]

Alexandre Poirot (:ochameau) 2011-10-28 05:22:04 PDT
commented in bug 665950:

There is still an issue with "Copy" feature.
If always fails if you have never create an addon while you signed in!

Steps to reproduce:
 Logout
 Sign in
 open any existing addon
 click on Copy
 --> CSRF error popup
 
 Now if you create an addon, then open an addon. Copy is going to work :o

Comment 21

[Wil Clouser [:clouserw]]

the add-on builder project has been retired.  More info at https://blog.mozilla.org/addons/2013/12/18/add-on-builder/