View Issue Details

IDProjectCategoryView StatusLast Update
0003543Composrcns_forumpublic2018-02-23 02:05
ReporterjacobgkauAssigned ToChris Graham 
SeverityFeature-request 
Status resolvedResolutionfixed 
Product Version 
Fixed in Version 
Summary0003543: Sending an IM and then deleting the sender's account causes the receiver to get errors
DescriptionWhen one user sends a private instant message to another user, and then the first user deletes their own account, the user who received the instant message will experience error messages/screens due to the left-over private topic notification. The receiver may see a white screen, or an error message stating "A parameter, BY_USERNAME, is referenced in the template, CNS_PRIVATE_TOPIC_LINK, but not passed."

After a user who experienced this issue on my live site contacted me about it, I was able to fix their account by going into phpMyAdmin and deleting the private topic and its messages from the database. As a temporary precaution, I have disabled the ability for users to delete their own accounts on my website, so that they'll either have to delete the individual messages themselves or contact me to do a full clean-up.
Steps To Reproduce1. Create two user accounts.

2. Send an instant message from one account to the other.

3. Delete the account that sent the instant message.

4. Using the remaining account, attempt to view pages.
Additional InformationI first experienced this issue on my live site running 10.0.12. I have reproduced the issue on a fresh test site running 10.0.13 (latest stable.)

I originally suspected that the Instant Messaging block was involved with this issue, as the user who contacted me was able to view all pages except for one with the IM block (where they were getting a PHP white screen.) However, while reproducing the error on a fresh site, it appears that the "parameter not passed" error message shows up on all screens (I'm assuming because it's coming from a Private Topic notification.)
TagsNo tags attached.
Time estimation (hours)
Sponsorship open

Activities

Chris Graham

2018-02-23 02:05

administrator   ~0005533

Thanks for the detailed report.

I just finished an extensive review of cases where we're reading in usernames without checking those members still exist.

https://github.com/ocproducts/composr/commit/40f0b7c939864315b0728a1f2ab57c3a667cb489

This is such a fragile thing easy for us to forget to do. For this reason the get_username API call was cleaned up in v11 to auto-handle it.

Issue History

Date Modified Username Field Change
2018-02-20 01:36 jacobgkau New Issue
2018-02-23 02:05 Chris Graham Note Added: 0005533
2018-02-23 02:05 Chris Graham Status non-assigned => resolved
2018-02-23 02:05 Chris Graham Resolution open => fixed
2018-02-23 02:05 Chris Graham Assigned To => Chris Graham