[Tickets #14259] Event notification from another user's private calendar

[noreply at bugs.horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: https://bugs.horde.org/ticket/14259
------------------------------------------------------------------------------
  Ticket             | 14259
  Created By         | lfbm.andamentos at gmail.com
  Summary            | Event notification from another user's private calendar
  Queue              | Kronolith
  Version            | 4.2.14
  Type               | Bug
  State              | Unconfirmed
  Priority           | 1. Low
  Milestone          |
  Patch              |
  Owners             |
------------------------------------------------------------------------------


lfbm.andamentos at gmail.com (2016-02-17 19:55) wrote:

Kronolith is issuing event alarms from  user's private calendar to  
another user who does not have access to tha calendar. The orange  
notification box appears with the alarm title on the screen of another  
user. When clicked on event title in the orange box, then the red  
notification box appears saying "event not found".

My system already has the fixed commit from here:
https://github.com/horde/horde/commit/4b482074340bf4e7ddc469d69172c5c0a2c761f8

So probably there is something else wrong.

Jens Wahnes has confirmed this in the kronolith's mail list:

> I didn't notice this on our test server, but since we updated our main
> server to the latest versions of Horde (including Kronolith 4.2.15),
> this is happening to us as well.
>
> The problem seems to stem from the horde-alarms script being run (a
> cronjob in our case). After the update, the horde-alarms script
> consumes way more memory than before and takes ages to run (before:
> less than a second, after the upgrade: more than a minute).
>
> After horde-alarms has run, the horde_alarms table is messed up. Compared
> with the state before, there are now duplicated entries that have got
> the same alarm_params etc. as the original entry, but the alarm_uid is
> another. I think that this is what causes the notifications to be
> displayed to the wrong user.
>
> Our tests so far indicate that neither downgrading Kronolith back to
> 4.2.8 nor downgrading Horde_Alarms back to 2.2.4 helps to resolve the
> issue. Which leaves me a bit puzzled what other upgraded package might
> be causing this. AFAICS, the duplicated events will have the owner  
> with the lowest
> share_id in the kronolith_sharesng table.  At least that's what
> happened in our case.  For testing purposes, we changed the user with
> the lowest id in kronolith_sharesng to someone else, and when we
> triggered the problem again, that user would wrongfully receive the
> notification email.