Public bug reported:

The following series of curl commands creates a user with an email
address of ‘[email protected]’, and then links 10 additional addresses to
[email protected]

curl -X POST --data "[email protected]&display_name=z" --header 
"authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses
curl -X POST --data "[email protected]" --header "authorization: Basic 
cmVzdGFkbWluOnJlc3RwYXNz" 
http://localhost:8001/3.0/users/[email protected]/addresses

A sqlite3 dump of the database shows the following in the addresses
table:

INSERT INTO "address" VALUES(11,'[email protected]',NULL,'z',NULL,'2015-02-08 
10:50:37.241724',5,17);
INSERT INTO "address" VALUES(12,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:08.928901',5,19);
INSERT INTO "address" VALUES(13,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:36.308978',5,20);
INSERT INTO "address" VALUES(14,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:43.947229',5,21);
INSERT INTO "address" VALUES(15,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:49.598934',5,22);
INSERT INTO "address" VALUES(16,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:54.406450',5,23);
INSERT INTO "address" VALUES(17,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:59.295078',5,24);
INSERT INTO "address" VALUES(18,'[email protected]',NULL,'',NULL,'2015-02-08 
10:53:04.892381',5,25);
INSERT INTO "address" VALUES(19,'[email protected]',NULL,'',NULL,'2015-02-08 
10:53:10.497119',5,26);
INSERT INTO "address" VALUES(20,'[email protected]',NULL,'',NULL,'2015-02-08 
10:53:16.450507',5,27);
INSERT INTO "address" VALUES(21,'[email protected]',NULL,'',NULL,'2015-02-08 
10:53:24.021368',5,28);

All good at this stage. No problems.

The following curl command deletes user ‘[email protected]’

curl --verbose -X DELETE --header "authorization: Basic
cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/[email protected]

Strangely, a sqlite3 dump of the database now shows the following in the
addresses table:

INSERT INTO "address" VALUES(12,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:08.928901',NULL,19);
INSERT INTO "address" VALUES(14,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:43.947229',NULL,21);
INSERT INTO "address" VALUES(16,'[email protected]',NULL,'',NULL,'2015-02-08 
10:52:54.406450',NULL,23);
INSERT INTO "address" VALUES(18,'[email protected]',NULL,'',NULL,'2015-02-08 
10:53:04.892381',NULL,25);
INSERT INTO "address" VALUES(20,'[email protected]',NULL,'',NULL,'2015-02-08 
10:53:16.450507',NULL,27);

So 6 of the addresses that should have been deleted were deleted, but 5
remain. The linked address deletion seems to be skipping addresses for
some reason.

It appears the problem is caused by the delete  address functionality
mutating the iterator of user addresses.

This appears to fix the problem, which is in rest/users.py

    def on_delete(self, request, response):
        """Delete the named user, all her memberships, and addresses."""
        if self._user is None:
            not_found(response)
            return
        for member in self._user.memberships.members:
            member.unsubscribe()
        user_manager = getUtility(IUserManager)
        addresses_for_deletion = []
        for address in self._user.addresses:
            # to avoid mutating the self._user.addresses iterator, create a 
separate list of addresses
            addresses_for_deletion.append(address)
        for address in addresses_for_deletion:
            user_manager.delete_address(address)
        user_manager.delete_user(self._user)
        no_content(response)

** Affects: mailman
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Mailman
Coders, which is subscribed to GNU Mailman.
https://bugs.launchpad.net/bugs/1419519

Title:
  REST API delete user function does not delete every 2nd linked address

To manage notifications about this bug go to:
https://bugs.launchpad.net/mailman/+bug/1419519/+subscriptions
_______________________________________________
Mailman-coders mailing list
[email protected]
https://mail.python.org/mailman/listinfo/mailman-coders

Reply via email to