FW: lvm2 wiki problems

FW: lvm2 wiki problems

[Alasdair G Kergon]

Anyone had chance to look at this yet?

At least please could you edit /wiki/lvm2.py so I can do other admin on the
wiki again even if I can no longer disable the accounts of users posting spam.

Alasdair

----- Forwarded message from Alasdair G Kergon <agk@redhat.com> -----

Date: Wed, 21 May 2008 18:37:00 +0100
From: Alasdair G Kergon <agk@redhat.com>
Subject: lvm2 wiki problems
To: overseers@sourceware.org

Has the wiki software been updated in the last few months?

I tried to disable a spammer's account as I've done before, but it seems to
have got confused between my admin account and the spammer's one:  I did the
'select user' thing to change to that user, it showed the new user at the top
of the screen confirming the switch, but the UserPreferences screen *still*
showed the 'select user' list (it did not used to do that) along with all the
settings for that user and when I checked the box to disable the user, it
gave a strange error saying the email address was already in use, so I changed
the email address, disabled it, the spammer then appeared twice in the list
with identical account names, and then found I could no longer log back in as
admin.   Or something like that.

Anyway, AGKE probably needs re-enabling/fixing, or forget it and change the
admin in the config file from AGKE to AGK.

   - And how do I now disable an account?
(Ideally there'd be a way to delete accounts in bulk - the majority are spammers.)

Also the manual Despam thing wasn't very useful because it only showed pages
that changed in the last day - older pages had to be deleted the slow way.
Can that timespan be extended?  (Haven't checked today to see if that's still true
and can't get in at the moment.)

Alasdair
-- 
agk@redhat.com

----- End forwarded message -----

Re: FW: lvm2 wiki problems

[Frank Ch. Eigler]

Hi -

On Thu, Jul 17, 2008 at 11:32:40AM +0100, Alasdair G Kergon wrote:
> At least please could you edit /wiki/lvm2.py so I can do other admin on the
> wiki again even if I can no longer disable the accounts of users posting spam.

I don't grok moinmoin, but superuser = "AGK" is now set.

- FChE

Re: FW: lvm2 wiki problems

[Daniel Berlin]

So, I upgraded MoinMoin to 1.7 in the past month, and MoinMoin
auto-downloads it's spam protection lists every few days.

If you want to do actual captcha style protection, MoinMoin's wiki
page says how to set up "textcha's"

If you add one or two to the config file, it should pretty much remove
all your spam.

On Thu, Jul 17, 2008 at 6:45 AM, Frank Ch. Eigler <fche@redhat.com> wrote:
> Hi -
>
> On Thu, Jul 17, 2008 at 11:32:40AM +0100, Alasdair G Kergon wrote:
>> At least please could you edit /wiki/lvm2.py so I can do other admin on the
>> wiki again even if I can no longer disable the accounts of users posting spam.
>
> I don't grok moinmoin, but superuser = "AGK" is now set.
>
> - FChE
>

Re: FW: lvm2 wiki problems

[Alasdair G Kergon]

Well I seem to be locked out again.

Look - even if you still haven't found time to update the wiki software to a
non-buggy version, please can you at least give me direct access to edit the
wiki data so I can attempt to fix the data corruption directly?

Alasdair


On Thu, Jul 17, 2008 at 11:32:40AM +0100, Alasdair G Kergon wrote:
> Anyone had chance to look at this yet?
> 
> At least please could you edit /wiki/lvm2.py so I can do other admin on the
> wiki again even if I can no longer disable the accounts of users posting spam.
> 
> Alasdair
> 
> ----- Forwarded message from Alasdair G Kergon <agk@redhat.com> -----
> 
> Date: Wed, 21 May 2008 18:37:00 +0100
> From: Alasdair G Kergon <agk@redhat.com>
> Subject: lvm2 wiki problems
> To: overseers@sourceware.org
> 
> Has the wiki software been updated in the last few months?
> 
> I tried to disable a spammer's account as I've done before, but it seems to
> have got confused between my admin account and the spammer's one:  I did the
> 'select user' thing to change to that user, it showed the new user at the top
> of the screen confirming the switch, but the UserPreferences screen *still*
> showed the 'select user' list (it did not used to do that) along with all the
> settings for that user and when I checked the box to disable the user, it
> gave a strange error saying the email address was already in use, so I changed
> the email address, disabled it, the spammer then appeared twice in the list
> with identical account names, and then found I could no longer log back in as
> admin.   Or something like that.
> 
> Anyway, AGKE probably needs re-enabling/fixing, or forget it and change the
> admin in the config file from AGKE to AGK.
> 
>    - And how do I now disable an account?
> (Ideally there'd be a way to delete accounts in bulk - the majority are spammers.)
> 
> Also the manual Despam thing wasn't very useful because it only showed pages
> that changed in the last day - older pages had to be deleted the slow way.
> Can that timespan be extended?  (Haven't checked today to see if that's still true
> and can't get in at the moment.)
> 
> Alasdair
> -- 
> agk@redhat.com
> 
> ----- End forwarded message -----

Re: FW: lvm2 wiki problems

[Daniel Berlin]

Dude, we run the latest stable release of moinmoin.
It has no "bugfixes" for any of the "problems" you are facing.
My guess is your browser auto-fllled the form.


On Sun, Dec 7, 2008 at 5:53 PM, Alasdair G Kergon <agk@redhat.com> wrote:
> Well I seem to be locked out again.
>
> Look - even if you still haven't found time to update the wiki software to a
> non-buggy version, please can you at least give me direct access to edit the
> wiki data so I can attempt to fix the data corruption directly?
>
> Alasdair
>
>
> On Thu, Jul 17, 2008 at 11:32:40AM +0100, Alasdair G Kergon wrote:
>> Anyone had chance to look at this yet?
>>
>> At least please could you edit /wiki/lvm2.py so I can do other admin on the
>> wiki again even if I can no longer disable the accounts of users posting spam.
>>
>> Alasdair
>>
>> ----- Forwarded message from Alasdair G Kergon <agk@redhat.com> -----
>>
>> Date: Wed, 21 May 2008 18:37:00 +0100
>> From: Alasdair G Kergon <agk@redhat.com>
>> Subject: lvm2 wiki problems
>> To: overseers@sourceware.org
>>
>> Has the wiki software been updated in the last few months?
>>
>> I tried to disable a spammer's account as I've done before, but it seems to
>> have got confused between my admin account and the spammer's one:  I did the
>> 'select user' thing to change to that user, it showed the new user at the top
>> of the screen confirming the switch, but the UserPreferences screen *still*
>> showed the 'select user' list (it did not used to do that) along with all the
>> settings for that user and when I checked the box to disable the user, it
>> gave a strange error saying the email address was already in use, so I changed
>> the email address, disabled it, the spammer then appeared twice in the list
>> with identical account names, and then found I could no longer log back in as
>> admin.   Or something like that.
>>
>> Anyway, AGKE probably needs re-enabling/fixing, or forget it and change the
>> admin in the config file from AGKE to AGK.
>>
>>    - And how do I now disable an account?
>> (Ideally there'd be a way to delete accounts in bulk - the majority are spammers.)
>>
>> Also the manual Despam thing wasn't very useful because it only showed pages
>> that changed in the last day - older pages had to be deleted the slow way.
>> Can that timespan be extended?  (Haven't checked today to see if that's still true
>> and can't get in at the moment.)
>>
>> Alasdair
>> --
>> agk@redhat.com
>>
>> ----- End forwarded message -----
>

Re: FW: lvm2 wiki problems

[Alasdair G Kergon]

On Sun, Dec 07, 2008 at 08:21:49PM -0500, Daniel Berlin wrote:
> Dude, we run the latest stable release of moinmoin.

Oh dear.  Maybe it's corrupt data behind it that's causing the trouble, then,
due to some quirk of the upgrade perhaps.

The spammer's username appears *twice* in the dropdown listbox now, which would
be impossible if the code was perfect.

And when you attempt to switch to that user, it appears to have succeeded - the
user's name appears at the top of the page, their email address appears etc.,
but when you choose 'disable' it appears to disable *my* account instead of the
spammer's which I supposedly already switched to - and I'm no longer able to
log in.  This procedure used to work before the code was upgraded.

> It has no "bugfixes" for any of the "problems" you are facing.

Then we need to investigate it ourselves and fix it, or attempt to report it
upstream.

> My guess is your browser auto-fllled the form.
 
Are you familiar with the form?  How on earth could firefox cause the server
to get confused between two users?

Alasdair
-- 
agk@redhat.com

Re: FW: lvm2 wiki problems

[Daniel Berlin]

On Sun, Dec 7, 2008 at 9:32 PM, Alasdair G Kergon <agk@redhat.com> wrote:
> On Sun, Dec 07, 2008 at 08:21:49PM -0500, Daniel Berlin wrote:
>> Dude, we run the latest stable release of moinmoin.
>
> Oh dear.  Maybe it's corrupt data behind it that's causing the trouble, then,
> due to some quirk of the upgrade perhaps.

Doubtful, because ...
>
> The spammer's username appears *twice* in the dropdown listbox now, which would
> be impossible if the code was perfect.

This is because you have changed the name of your account to his.


>
> And when you attempt to switch to that user, it appears to have succeeded - the
> user's name appears at the top of the page, their email address appears etc.,
> but when you choose 'disable' it appears to disable *my* account instead of the
> spammer's which I supposedly already switched to - and I'm no longer able to
> log in.  This procedure used to work before the code was upgraded.
>
>> It has no "bugfixes" for any of the "problems" you are facing.
>
> Then we need to investigate it ourselves and fix it, or attempt to report it
> upstream.
>
>> My guess is your browser auto-fllled the form.
>
> Are you familiar with the form?  How on earth could firefox cause the server
> to get confused between two users?

I am familiar with the form.
I have used it before.
I have watch firefox reset the email address and username in the form
after you select a user to the previous one you had selected, because
the field names don't change.
If you then submit it, voila, it will change your username and email
address to the previous one.

This really is user error.
Should it have prevented you from making two accounts with the same user name?
Probably.
Was it "data corruption"? No.

Re: FW: lvm2 wiki problems

[Alasdair G Kergon]

On Sun, Dec 07, 2008 at 09:40:26PM -0500, Daniel Berlin wrote:
> On Sun, Dec 7, 2008 at 9:32 PM, Alasdair G Kergon <agk@redhat.com> wrote:
> > On Sun, Dec 07, 2008 at 08:21:49PM -0500, Daniel Berlin wrote:
> >> Dude, we run the latest stable release of moinmoin.
> > The spammer's username appears *twice* in the dropdown listbox now, which would
> > be impossible if the code was perfect.
 
> This is because you have changed the name of your account to his.
 
No - I have switched user to be *logged in* as him.
There is no functionality available to *change* account names.

> I am familiar with the form.
> I have used it before.

Sorry, but I'm afraid it doesn't seem like it...

> I have watch firefox reset the email address and username in the form
> after you select a user to the previous one you had selected, because
> the field names don't change.
> If you then submit it, voila, it will change your username and email
> address to the previous one.

Ehhh?  You *can't* edit the username!
 
> This really is user error.

I totally disagree.

> Should it have prevented you from making two accounts with the same user name?
> Probably.

There's no functionality to make new accounts on the page I am talking about!
- This page edits preferences of *existing* accounts.

> Was it "data corruption"? No.

Yes.

> >> It has no "bugfixes" for any of the "problems" you are facing.

Well I've just done a quick web search and it *is* a known bug:
  http://moinmo.in/MoinMoinBugs/SavingUserPreferencesAsSuperuser

And there is no workaround mentioned there i.e. seems to be no way to disable
the accounts of spammers now without write access to the wikidata to do it by
hand.

But there is a suggestion that this may fix it:
  auth = [moin_cookie, http]

Could it be something related to that that changed during the last upgrade?

Alasdair
-- 
agk@redhat.com

Re: FW: lvm2 wiki problems

[Daniel Berlin]

On Sun, Dec 7, 2008 at 10:00 PM, Alasdair G Kergon <agk@redhat.com> wrote:
> On Sun, Dec 07, 2008 at 09:40:26PM -0500, Daniel Berlin wrote:
>> On Sun, Dec 7, 2008 at 9:32 PM, Alasdair G Kergon <agk@redhat.com> wrote:
>> > On Sun, Dec 07, 2008 at 08:21:49PM -0500, Daniel Berlin wrote:

>> >> It has no "bugfixes" for any of the "problems" you are facing.
>
> Well I've just done a quick web search and it *is* a known bug:
No, this is a wildly different bug.
Did you even read it?

>  http://moinmo.in/MoinMoinBugs/SavingUserPreferencesAsSuperuser
1. This bug was because the guy was using NTLM auth, not moin moin
auth like we do.
Your suggested workaround will have no effect, because that is already
our setting!
2. This problem they report occurs in every version we have ever run
(we started with 1.5.4, which you'll note, is what the "bug" was
reported against), so your claim that it is somehow related to our
upgrade would be, er, strange at best.
3. Also, it was marked "Not a MoinMoin bug"
Because this is a bug caused by the fact that when he refreshes the
page, NTLM's auth module still says he is authed as one user, so it
happily writes out the prefs for that user.
The suggested workaround, use moinmoin cookies as the first auth
method, is what we do since we don't use http auth.

Again, did you actually read this bug?

I really don't feel like going through this with you again and again.
I renamed your AGKR account to AGK, which should give you back superuser.

I'll pray to god we don't suffer this "data corruption" again.

Re: FW: lvm2 wiki problems

[Alasdair G Kergon]

On Sun, Dec 07, 2008 at 10:12:48PM -0500, Daniel Berlin wrote:
> On Sun, Dec 7, 2008 at 10:00 PM, Alasdair G Kergon <agk@redhat.com> wrote:
> > On Sun, Dec 07, 2008 at 09:40:26PM -0500, Daniel Berlin wrote:
> >> On Sun, Dec 7, 2008 at 9:32 PM, Alasdair G Kergon <agk@redhat.com> wrote:
> >> > On Sun, Dec 07, 2008 at 08:21:49PM -0500, Daniel Berlin wrote:
> >> >> It has no "bugfixes" for any of the "problems" you are facing.
> > Well I've just done a quick web search and it *is* a known bug:
> No, this is a wildly different bug.
> Did you even read it?
> >  http://moinmo.in/MoinMoinBugs/SavingUserPreferencesAsSuperuser

The "steps to reproduce" are precisely the same as what I did.
And the result is the same - it is overwriting my settings with the other
user's because the "switch user" is failing to have any effect.

> Your suggested workaround will have no effect, because that is already
> our setting!

Hmmm.

> 2. This problem they report occurs in every version we have ever run
> (we started with 1.5.4, which you'll note, is what the "bug" was
> reported against), so your claim that it is somehow related to our
> upgrade would be, er, strange at best.

The functionality worked perfectly prior to the upgrade - I regularly
used this to disable users.

> I renamed your AGKR account to AGK, which should give you back superuser.
 
That's worked, thanks.

> I'll pray to god we don't suffer this "data corruption" again.

So the question remains: How do I now disable a user, given that the
documented procedure using the interface fails?

- Select user does not really change the user any more for the purposes
of changing that user's preferences and disabling their account.

Alasdair
-- 
agk@redhat.com