anki addon updated without new commits?

voidplayer commented 2 years ago

This addon has been updated today in anki without new commits. Are you using a different repo or have you been hacked?

sobjornstad commented 2 years ago

Thanks for bringing this to my attention in case there was a security issue. No, I didn't update LPCG. This looks like a bug in Anki to me, because the AnkiWeb page still shows the last updated date in 2021.

voidplayer commented 2 years ago

Strange, I do have lots of addons and it only happened to this one. Did it happen to you too?

sobjornstad commented 2 years ago

I had it installed symlinked to the development version on my PC, rather than through AnkiWeb. I'm going to download it right now and diff it against my local build just to be safe.

voidplayer commented 2 years ago

Btw, thanks for this addons, im learning poetry with it :D

voidplayer commented 2 years ago

I diffed it against master and theres a new dialog window, although is hard to tell if it did something else, since i run it before doing the diff

sobjornstad commented 2 years ago

There's no difference for me. What version of Anki are you using? Possible you got a different one due to that?

(I also discovered I have some local changes I forgot to publish, but that's a different issue)

sobjornstad commented 2 years ago

Sorry, that's not true, hang on let me investigate further. Still interested in knowing what Anki version you have.

voidplayer commented 2 years ago

I was in linux 1.49 when it happened. I just updated to linux 1.52 qt6

sobjornstad commented 2 years ago

OK, here are the facts:

AnkiWeb's date stamp aligns with the datestamp on master in the repository (July 24, 2021). I have not updated either the public repository or AnkiWeb this year at all, much less in the last couple of days.
The version on my local repository (which has 2 commits not on public master, not sure how that happened) was last updated January 6, 2022. I guess I meant to publish a new version then.
You're seeing an "addition" of import_dialog.py in your diff because that's generated code, and as such is included in the build, but not in the repository. If you run make in your repository (and you have all the right devtools), that difference should go away.
When I clean and rebuild locally from origin/master and diff an extract of the resulting .ankiaddon file against the version in the plugin I just downloaded, everything is identical (except the meta.json and the __pycache__, which are created by Anki as it uses the plugin).

So I think everything is fine and as expected (except that I need to cut a new version because I forgot to).

However, I still have no idea at all why you were informed there was an update even though no update has been published to AnkiWeb, unless you had an older version for a long time and Anki only noticed the version published a year ago (!) recently for some reason? If you were pre-2.1.44, you would have been given a different version by AnkiWeb, but that doesn't appear to be the case here.

Out of an abundance of caution, I have changed my AnkiWeb password, but if you're concerned you should probably report this to the main Anki repository, as there's not really any reason to think that if there was some kind of security issue, it was on my side. I don't think there's any reason to be concerned since the code is identical though.

voidplayer commented 2 years ago

Okay, i check the date in my files, and i was in 1.43 2 days ago, so that is the problem. Most addons have updated now

Im kinda embarrassed for entering panic mode 😅

Thanks for the troubleshooting! And the addon!

sobjornstad / AnkiLPCG

anki addon updated without new commits? #33