hannesmannerheim / qvitter

mirror. moved to https://git.gnu.io/h2p/Qvitter, send merge requests and issues there
https://git.gnu.io/h2p/Qvitter
GNU Affero General Public License v3.0
86 stars 26 forks source link

Infinite notices onNoticeDeleteRelated when deleting user/profile #238

Closed ghost closed 9 years ago

ghost commented 9 years ago

When you delete a User or a Profile in GNU social, Qvitter will infinitely create new notices by this user so the tables are never emptied and the user/profile can never be deleted.

The event currently runs on onNoticeDeleteRelated, but there is a pair of onStartDeleteOwnNotice and onEndDeleteOwnNotice that I think are more appropriate. Probably the latter.

It appears those events send a User object though, not a Profile object, so it might be difficult to implement this with remote profiles, but as remote profiles can't delete notices right now (though I haven't looked at what Qvitter does when a qvitter-delete-notice verb comes in) that might not be a problem.

Anyway, I will hopefully have some time to look at this tonight unless it's already been solved by then :)

hannesmannerheim commented 9 years ago

StartDeleteOwnNotice and EndDeleteOwnNotice is only run when deleting from the UI or API.

NoticeDeleteRelated is the only event available when running Notice::delete() which Qvitter does

Maybe we can do a if(!User::hasRole(Profile_role::DELETED)) before outputting a qvitter-delete-notice acitivity notice. I'll see if that works

knut-erik commented 9 years ago

To get that if clause to work it depends if the user has that role in the beginning of the process or in the end of the deletion process.

hannesmannerheim commented 9 years ago

yes, i'm testing right now

hannesmannerheim commented 9 years ago

it worked :)

hannesmannerheim commented 9 years ago

now we need a qvitter-delete-user activity notice that deletes the profile on remote instances also :)

ghost commented 9 years ago

Let's make sure you can't spoof notices first, perhaps? ;)

hannesmannerheim commented 9 years ago

i thought that only was possible if the profile was unknown to the instance? if the profile is known to the instance it sounds like a super duper easy thing to stop?

hannesmannerheim commented 9 years ago

but you know this better than me. i'm just a simple plugin developer. i trust the core to be secure :)