• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use View topic Item7848 for generic doc work for TWiki-6.1.1. Use View topic Item7851 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
Does this site look broken?. Use the LitterTray web for test cases.

Item5311: deep recursion in getEmails()

Item Form Data

AppliesTo: Component: Priority: CurrentState: WaitingFor: TargetRelease ReleasedIn
Engine   Urgent Closed   patch 4.2.1, 5.0.0

Edit Form Data

Summary:
Reported By:
Codebase:
Applies To:
Component:
Priority:
Current State:
Waiting For:
Target Release:
Released In:
 

Detail

Here's how to reproduce:

  1. create a user with login name foo
  2. create a group foo
  3. add user foo to group foo
  4. add some %USERINFO% to a test topic ... bam

This situation may occur mostly in user mappers like the LdapContrib where users and groups can be defined that way. In a unix/posix setup, users are often created together with a group of the same name, which then becomes the default group for that user.

The deep recursion happens in TWiki::Users::TWikiUserMapping::getEmails(), a recursive function. By default, TWiki can't distinguish between the user foo and the group foo, and will fall into an infinit recursion expanding all email addresesses of all members of that group. The solution is to add hash parameter that tracks the users getEmails() has already been called for. On the other hand, the next release of LdapContrib will check this situation as well and prevent the creation of groups with names of already existing users.

-- TWiki:Main/MichaelDaum - 01 Feb 2008

Michael this sounds serious. Should the TWikiUserMappingContrib part of the fix be merged to the TWikiRelease04x02 branch?

-- TWiki:Main.KennethLavrsen - 01 Feb 2008

This is barely reproducable without LdapContrib ... which I added a workaround so that it does not trigger this circumstances in the core code anymore.

Nevertheless, the TWikiUserMappingContrib in the 4.2 branch should be updated. Infact, I expect this not to be the last change to this package within the next patch release.

-- TWiki:Main.MichaelDaum - 02 Feb 2008

Will you merge over the relevant changes to TWikiRelease04x02 branch please, Michael?

-- TWiki:Main.KennethLavrsen - 03 Feb 2008

merged - its not a big deal thou, as its somewhat hard to hit.

-- SvenDowideit - 10 Mar 2008

Cleaned "WaitingFor" field.

-- TWiki:Main.GilmarSantosJr - 10 Aug 2008

ItemTemplate
Summary deep recursion in getEmails()
ReportedBy TWiki:Main.MichaelDaum
Codebase 4.2.0, 4.2.1
SVN Range TWiki-5.0.0, Wed, 23 Jan 2008, build 16283
AppliesTo Engine
Component

Priority Urgent
CurrentState Closed
WaitingFor

Checkins TWikirev:16335 TWikirev:16336 TWikirev:16505
TargetRelease patch
ReleasedIn 4.2.1, 5.0.0
Edit | Attach | Watch | Print version | History: r10 < r9 < r8 < r7 < r6 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r10 - 2008-08-10 - GilmarSantosJr
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2019 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback