evilaliv3
commented
9 months ago Thank you @mapreri
You are correct about this topic and with your suggestion for improval.
Globaleaks for security reason was written small and contains all the checks (in this case unique and foreign constraints) that prevent situations of this kind but still miss error messages like the one that you mention.
The main reason of this is the fact that adding a single text to the software require translation in 90 languages and thus requires to make things right at first
As the software is open source wow that the community of users is growing we hope the community could study with us this aspects and join us in the development.
Do you have by any chance will and possibility to support this improvement?
mapreri
What version of GlobaLeaks are you using?
4.13.18
What browser(s) are you seeing the problem on?
All
What operating system(s) are you seeing the problem on?
Linux
Describe the issue
An administrator tried to create a user, accidentally using the same username of another user already present in the same site.
I got this error via email:
SQLAlchemy error
``` sqlalchemy.exc.IntegrityError Wraps a DB-API IntegrityError. Traceback (most recent call last): File "/usr/lib/python3/dist-packages/sqlalchemy/engine/base.py", line 1802, in _execute_context self.dialect.do_execute( File "/usr/lib/python3/dist-packages/sqlalchemy/engine/default.py", line 732, in do_execute cursor.execute(statement, parameters) sqlite3.IntegrityError: UNIQUE constraint failed: user.tid, user.username The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 1656, in _inlineCallbacks result = current_context.run( File "/usr/lib/python3/dist-packages/twisted/python/failure.py", line 489, in throwExceptionIntoGenerator return g.throw(self.type, self.value, self.tb) File "/usr/lib/python3/dist-packages/globaleaks/handlers/admin/user.py", line 187, in post user = yield create_user(self.request.tid, self.session, request, self.request.language) File "/usr/lib/python3/dist-packages/twisted/python/threadpool.py", line 244, in inContext result = inContext.theWork() # type: ignore[attr-defined] File "/usr/lib/python3/dist-packages/twisted/python/threadpool.py", line 260, inI've been told (I honestly didn't try this myself) that from the web interface, they only got a very generic red float box saying "failed to create user" or something similar.
Proposed solution
I think you should have a nicer form validation step on submission without trying to commit to database, failing, and have to notify all the admins of this trivial error.
Thank you!