I've filled this upstream 
https://bugs.chromium.org/p/gerrit/issues/detail?id=8493 it seems it was me who 
added this functionality in gerrit 
https://github.com/GerritCodeReview/gerrit/commit/580ae0e94659dcb09463775b93472be129905949
 . 

    On Tuesday, 6 March 2018, 10:02:16 GMT, Jaime Crespo 
<jcre...@wikimedia.org> wrote:  
 
 > I suppose if you took control of a change (via adding your patch set to the 
 > CR) it would result in you deleting others' changes.

I didn't, I think it was because I was a gerrit admin.

On Tue, Mar 6, 2018 at 1:36 AM, Chad Horohoe <choro...@wikimedia.org> wrote:

On Mon, Mar 5, 2018 at 12:01 PM Jaime Crespo <jcre...@wikimedia.org> wrote:

I just been told there is now a delete button, DON'T USE IT- I just pressed it 
by mistake after entering in edit mode thinking it was a "discard patch started 
on web interface" (but it is very easy to pres it by mistake), and apparently 
it removes the entire CR. I was told by Paladox this is a new feature on 
gerrit, and I do not like it already. I managed to delete the work of a 
workmate. :-(

I could restore everthing from the database backups, but as it also deletes the 
git files content, it doesn't work without it -it cannot be reverted- only text 
can be recover from the database in not the nicest formatting.

Apologies for the damages caused. Should I file a ticket to propose to disable 
such a button from the UI?

Sooooo, this is supposed to be "Delete Own Changes" but I suppose if you took 
control of a change (via adding your patch set to the CR) it would result in 
you deleting others' changes. That's a *horrible* privilege escalation!
No need for a ticket, I've disabled this.
-Chad



-- 
Jaime Crespo
<http://wikimedia.org>
_______________________________________________
QA mailing list
QA@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/qa
  
_______________________________________________
QA mailing list
QA@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/qa

Reply via email to