openlibrary
openlibrary copied to clipboard
4045/bug/deleted work prevents edit reversion
Closes #4045
Currently, there is an exploit in our mass-revert feature that spammers are abusing. When a user is blocked and all of their edits are reverted en masse, the process will stall if any of their edits reference deleted works. This R will causes the reversion process to instead skip past these defunct edits, allowing the overall process to succeed.
Technical
Currently, the problem arises in infogami.infobase.writequery.SaveProcesser.process_value
, where type-checking occurs for the various keys involved in saving changes. Rather than altering infogami's functionality in this manner, the implemented solution instead checks each key referenced in each changeset for deleted keys earlier in the process, back in openlibrary.plugins.admin.code.people_view.POST_block_account_and_revert
, and only passes the changeset ids without these references to be reverted.
This could theoretically result in a problem, if a user with a sufficiently large edit history is being reverted, due to the large amount of information being fetched. Currently, it is being investigated if this is likely to happen.
Testing
The first step for verifying this PR is to create two separate user accounts. Each user account should create a work, and an edition. Then, each user should edit the other user's work. Lastly, each user should then be blocked, and have their edits reverted.
Stakeholders
@cdrini