[kronolith] Event notification from another user private calendar

[Jens Wahnes]

On Tue, Feb 16 2016, at 11:49:41 -0200, Luis Felipe Marzagao wrote:

> Em 15/02/2016 11:47, Luis Felipe Marzagao escreveu:
>> Hello:
>>
>> I´ve just been notified in kronolith (the orange bottom-right box) about
>> an event that was created by another user in his private calendar.
>>
>> I do not have access to that calendar. It´s not listed in my shared
>> calendars.
>>
>> If I click on the event name at the orange notification box I get a
>> "Event not found" error (red box). Probably because I don´t have access
>> to that event, as expected, since it´s private for that user.
>>
>> We are using kronolith 4.2.14.
>
> Today it has happened again.

I didn't notice this on our test server, but since we updated our main
server to the latest versions of Horde (including Kronolith 4.2.15),
this is happening to us as well.

The problem seems to stem from the horde-alarms script being run (a
cronjob in our case). After the update, the horde-alarms script
consumes way more memory than before and takes ages to run (before:
less than a second, after the upgrade: more than a minute).  After
horde-alarms has run, the horde_alarms table is messed up. Compared
with the state before, there are now duplicated entries that have got
the same alarm_params etc. as the original entry, but the alarm_uid is
another. I think that this is what causes the notifications to be
displayed to the wrong user.

Our tests so far indicate that neither downgrading Kronolith back to
4.2.8 nor downgrading Horde_Alarms back to 2.2.4 helps to resolve the
issue. Which leaves me a bit puzzled what other upgraded package might
be causing this.

> One additional information: apparently the notification is only  
> appearing for the calendar owner and for me and I´m registered as admin  
> in $conf[auth][admins]. I wonder if being an admin is causing this.

AFAICS, the duplicated events will have the owner with the lowest
share_id in the kronolith_sharesng table.  At least that's what
happened in our case.  For testing purposes, we changed the user with
the lowest id in kronolith_sharesng to someone else, and when we
triggered the problem again, that user would wrongfully receive the
notification email.


Jens
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
URL: <http://lists.horde.org/archives/kronolith/attachments/20160217/e1adb5f3/attachment.bin>