openlibrary icon indicating copy to clipboard operation
openlibrary copied to clipboard

4045/bug/deleted work prevents edit reversion

Open benbdeitch opened this issue 10 months ago • 0 comments

Closes #4045

Currently, there is an exploit in our mass-revert feature that spammers are abusing. When a user is blocked and all of their edits are reverted en masse, the process will stall if any of their edits reference deleted works. This R will causes the reversion process to instead skip past these defunct edits, allowing the overall process to succeed.

Technical

Currently, the problem arises in infogami.infobase.writequery.SaveProcesser.process_value, where type-checking occurs for the various keys involved in saving changes. Rather than altering infogami's functionality in this manner, the implemented solution instead checks each key referenced in each changeset for deleted keys earlier in the process, back in openlibrary.plugins.admin.code.people_view.POST_block_account_and_revert, and only passes the changeset ids without these references to be reverted.

This could theoretically result in a problem, if a user with a sufficiently large edit history is being reverted, due to the large amount of information being fetched. Currently, it is being investigated if this is likely to happen.

Testing

The first step for verifying this PR is to create two separate user accounts. Each user account should create a work, and an edition. Then, each user should edit the other user's work. Lastly, each user should then be blocked, and have their edits reverted.

Stakeholders

@cdrini

benbdeitch avatar Apr 02 '24 19:04 benbdeitch