Launchpad itself

Cannot accept package which would notify private email addresses

Bug #566339 reported by William Grant
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
Colin Watson

Bug Description

ScottK could not accept ibid from Lucid source NEW today -- he received a 403. I suspect that this is due to the private email address of the person in Changed-By. Trying it locally:

[...]
Module lp.soyuz.browser.queue, line 399, in queue_action_reject
queue_item.rejectFromQueue()
Module lp.soyuz.model.queue, line 436, in rejectFromQueue
changes_file_object=changes_file_object)
Module lp.soyuz.model.queue, line 1078, in notify
recipients = self._getRecipients(changes)
Module lp.soyuz.model.queue, line 1148, in _getRecipients
person.preferredemail.email)
Unauthorized: (<EmailAddress at 0xe63366c <email address hidden> [Preferred Email Address]>, 'email', 'launchpad.View')<br />

I believe it only fails if it would send a notification to the private email address; using the private email address in the email (eg. if the person is deactivated) seems to work fine.

Related branches

lp:~cjwatson/launchpad/async-upload-notifications
William Grant: Approve (code)
Diff: 820 lines (+472/-28)
13 files modified
database/schema/security.cfg (+2/-0)
lib/lp/services/config/schema-lazr.conf (+6/-0)
lib/lp/soyuz/configure.zcml (+20/-0)
lib/lp/soyuz/doc/distroseriesqueue.txt (+15/-0)
lib/lp/soyuz/enums.py (+15/-1)
lib/lp/soyuz/interfaces/archivejob.py (+66/-0)
lib/lp/soyuz/interfaces/queue.py (+6/-2)
lib/lp/soyuz/model/archivejob.py (+173/-0)
lib/lp/soyuz/model/queue.py (+9/-16)
lib/lp/soyuz/stories/soyuz/xx-queue-pages.txt (+17/-0)
lib/lp/soyuz/tests/test_archivejob.py (+113/-0)
lib/lp/soyuz/tests/test_packagecopyjob.py (+12/-9)
lib/lp/soyuz/tests/test_packageupload.py (+18/-0)
Revision history for this message
Julian Edwards (julian-edwards) wrote :

Essentially the same problem as bug 564491 and will require the same fix.

Changed in soyuz:
status: New → Triaged
importance: Undecided → High
milestone: none → pending
Revision history for this message
Scott Kitterman (kitterman) wrote :

I'm still getting bit by this periodically. Happened this week again.

Revision history for this message
Julian Edwards (julian-edwards) wrote :

Unfortunately it's quite hard to fix, unless we put in a horrible hack to work around security. I'll look into it again soon and see if that's more feasible than I thought.

Revision history for this message
Scott Kitterman (kitterman) wrote : Re: [Bug 566339] Re: Cannot accept package which would notify private email addresses

Thanks. The function has a small userbase, so I understand it's not on the
top of the list.

Revision history for this message
Julian Edwards (julian-edwards) wrote :

I *think* I have this fixed along with that other bug. William, I'm not sure your trace is relevant, it's the code at the bottom of close_bugs_for_sourcepackagerelease() where does bug.newMessage().

Scott, I'll tentatively mark this fixed when the branch lands. Please re-open the bug if the problem occurs again after we do the next release.

Changed in soyuz:
status: Triaged → In Progress
Revision history for this message
Scott Kitterman (kitterman) wrote : Re: [Bug 566339] Re: Cannot accept package which would notify private email addresses

Will do. Thanks.

Revision history for this message
William Grant (wgrant) wrote :

Julian, I don't think my trace is irrelevant -- I created it by reproducing the situation locally, knowing that the Changed-By address was private.

Revision history for this message
William Grant (wgrant) wrote :

I think there's another bug for the private bug problem.

Revision history for this message
Launchpad QA Bot (lpqabot) wrote : Bug fixed by a commit

Fixed in stable r11556 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/11556>.

Changed in soyuz:
assignee: nobody → Julian Edwards (julian-edwards)
milestone: pending → 10.10
tags: added: qa-needstesting
Changed in soyuz:
status: In Progress → Fix Committed
Steve Kowalik (stevenk)
Changed in soyuz:
status: Fix Committed → Triaged
Robert Collins (lifeless)
tags: removed: qa-needstesting
Revision history for this message
Robert Collins (lifeless) wrote :

Marked as qa-untestable to get past the deployment bot

tags: added: qa-untestable
Julian Edwards (julian-edwards)
tags: removed: qa-untestable
Changed in soyuz:
milestone: 10.10 → none
Julian Edwards (julian-edwards)
Changed in launchpad:
assignee: Julian Edwards (julian-edwards) → nobody
Revision history for this message
Robert Collins (lifeless) wrote :

So, if we move to an event based notification system, I think that will become a little easier. Obviously the address in the changed-by is public, because the dsc file is copied verbatim to the (relevant) archive.

tags: added: email notifications
Revision history for this message
Robert Collins (lifeless) wrote :

s/public/disclosable to the archive being uploaded to/

Colin Watson (cjwatson)
Changed in launchpad:
assignee: nobody → Colin Watson (cjwatson)
status: Triaged → In Progress
Revision history for this message
Launchpad QA Bot (lpqabot) wrote :

Fixed in stable r17714 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/17714>.

tags: added: qa-needstesting
Changed in launchpad:
status: In Progress → Fix Committed
Colin Watson (cjwatson)
tags: added: qa-ok
removed: qa-needstesting
Colin Watson (cjwatson)
Changed in launchpad:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.