Modify

Opened 9 years ago

Closed 9 years ago

Last modified 9 years ago

#3131 closed defect (fixed)

The use of env as a global variable in dbhelper.py looks dangerous

Reported by: jonas@… Owned by: Russ Tyndall
Priority: highest Component: TimingAndEstimationPlugin
Severity: critical Keywords:
Cc: Trac Release: 0.11

Description

Unless I'm missing something the way dbhelper.py stores the env in a global variable is really unsafe. With thread based frontends like tracd or fastcgi this global variable can at anytime be modified by another thread to point to another environment. And this can cause the wrong database to be modified.

Attachments (0)

Change History (4)

comment:1 Changed 9 years ago by Russ Tyndall

I hadnt realized that when I wrote it. I will attempt to fix this very soon.

comment:2 Changed 9 years ago by Russ Tyndall

Priority: normalhighest
Severity: normalcritical

I have this patched, but am going to wait till I can test everything in the morning before publishing this.

Thanks again,

Russ

comment:3 Changed 9 years ago by Russ Tyndall

Resolution: fixed
Status: newclosed

(In [3784]) closes #3131
closes #3074
T&E 0.6.6

Fixes horrible bug relating to database access (due to my misunderstanding of which things were stateful in trac/python).

Fixed some bugs in the way billable values were being compared in the reports file (strong vs week typed databases)

comment:4 Changed 9 years ago by Russ Tyndall

(In [3785]) closes #3131
closes #3074
T&E(trac 10) 0.6.6

I brought the trac 10 branch up to the same version number of the plugin so that hopefully there is less confusion on my part about versions.

Fixes horrible bug relating to database access (due to my misunderstanding of which things were stateful in trac/python).

Fixed some bugs in the way billable values were being compared in the reports file (strong vs weak typed databases)

Modify Ticket

Action
as closed The owner will remain Russ Tyndall.
The resolution will be deleted. Next status will be 'reopened'.

Add Comment


E-mail address and name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.