Plots2: Ban Error

[bronwen9]

Issue reversing ban on user profile.

We have a user who seems to have been banned in error, and when I try to unban their profile, I get a notice saying that the profile is unbanned, but the profile's status remains unchanged.

This issue was discovered about an hour after the first attempt at unbanning was made, and persists even after refreshing the page.

(redacted)

[grvsachdeva]

Hey @bronwen9, thanks for reporting. Inspecting the cause..

[grvsachdeva]

@jywarren there is no such issue faced locally. Also, I find 2 alerts suspicious, like first alert The user has been unbanned is generated from admin_controller here - https://github.com/publiclab/plots2/blob/master/app/controllers/admin_controller.rb#L296-L305

and second alert That user has been banned from users_controller while reloading the profile page - https://github.com/publiclab/plots2/blob/master/app/controllers/users_controller.rb#L205-L217

So, unban function is doing it's work but when we redirect to profile page, there it is found that user status is unchanged. Which is weird :confused:

[jywarren]

Could it be this?

https://github.com/publiclab/plots2/blob/e7d1315189f3e4b7ad0e1f50c1ed74c1d371c6bf/app/models/user.rb#L289-L294

[grvsachdeva]

But, in the snippet added by you @jywarren, we are changing the status back to normal and that's how it's working locally.

[grvsachdeva]

Hi @bronwen9 @jywarren, unban user seems to work now. Try on https://publiclab.org/profile/rajat (created by me so feel free to test).

@jywarren I checked the history of users_controller, admin_controller and models/user.rb but haven't seen any specific change which fixed it. Do you think it could be profile specific?

Thanks!

[bronwen9]

Hi-

I went to check the profile for the person that had originally raised this
issue so I could tell them it had been reinstated, but it still doesn't
seem possible to unban it. Can we do something else for this person? It
seems a shame for their posts to be hidden.

Thanks!

On Sat, Apr 13, 2019 at 8:02 AM Gaurav Sachdeva [e-mail]
wrote:

Hi @bronwen9 https://github.com/bronwen9 @jywarren
https://github.com/jywarren, unban user seems to work now. Try on
https://publiclab.org/profile/rajat (created by me so feel free to test).

@jywarren https://github.com/jywarren I checked the history of
users_controller, admin_controller and models/user.rb but haven't seen any
specific change which fixed it. Do you think it could be profile specific?

Thanks!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/publiclab/plots2/issues/5303#issuecomment-482803152,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AH8hxUoEtyYgVvTWwi69qrLxNRn6YnM5ks5vgcdZgaJpZM4cSP8U
.

[grvsachdeva]

Hi @bronwen9, sorry for the inconvenience, and yes, we can change the status by another medium for now. @jywarren can you please change that user's status to 1 from the console for now? Also, please copy the prod logs here of unbanning activity for that user before changing the status from console(for debugging).

Thanks!

[bronwen9]

I'll add that when I click "unban", I get a popup saying that the user has
been unbanned, but the status remains unaffected. Thanks for your help!

On Mon, Apr 15, 2019 at 9:40 AM Gaurav Sachdeva [e-mail]
wrote:

Hi @bronwen9 https://github.com/bronwen9, sorry for the inconvenience,
and yes, we can change the status by another medium for now. @jywarren
https://github.com/jywarren can you please change that user's status to
1 from the console for now? Also, please copy the prod logs here of
unbanning activity for that user before changing the status from
console(for debugging).

Thanks!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/publiclab/plots2/issues/5303#issuecomment-483255853,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AH8hxU4FU8FKWsEyufbDIB6QnVe6V96oks5vhIFFgaJpZM4cSP8U
.

[jywarren]

Hi all, thanks for looking into this. It was confusing because we have tests for this confirming it was working, and it did work for other users. But not for this account.

I had tried a couple times without success to unban, so I followed @gauravano's suggestion of doing this in the rails console (in the database), but that also failed. I looked further and saw that the account did not have a password assigned. I'm not sure how this happened, but it could be related to it being migrated from a Drupal account, as the last activity was 5 years ago.

I used the reset password tool (which anyone can activate; it emails the original email associated with the account with a reset key, and also shows the reset key to admins on the profile page). I created a new password, then tried unbanning again, and this time it worked.

So in the future if this comes up, try regenerating the password (the reset link should be emailed but can also be copy-pasted into an email by an admin, just be sure it's really the same person). Then unban. You can also do what I did, and just use the reset link yourself as an admin to make a temp password, unban, then tell the person to try resetting the password again.

For some stats on how common this scenario may be:

irb(main):004:0> User.where(crypted_password: nil).count
=> 1672
irb(main):005:0> User.where(crypted_password: nil, status: 0).count
=> 1619

Many are real users I recognize.

I'm further refining the list to only those who have ever logged in; this will take a bit. I can unban the whole list if it looks to remove enough spam accounts; 1600 is not so many accounts.

[bronwen9]

Thanks for figuring that out! I'll let the person know.

On Mon, Apr 15, 2019, 2:29 PM Jeffrey Warren [e-mail]
wrote:

Hi all, thanks for looking into this. It was confusing because we have
tests for this confirming it was working, and it did work for other users.
But not for this account.

I had tried a couple times without success to unban, so I followed
@gauravano https://github.com/gauravano's suggestion of doing this in
the rails console (in the database), but that also failed. I looked further
and saw that the account did not have a password assigned. I'm not sure how
this happened, but it could be related to it being migrated from a Drupal
account, as the last activity was 5 years ago.

I used the reset password tool (which anyone can activate; it emails the
original email associated with the account with a reset key, and also shows
the reset key to admins on the profile page). I created a new password,
then tried unbanning again, and this time it worked.

So in the future if this comes up, try regenerating the password (the
reset link should be emailed but can also be copy-pasted into an email by
an admin, just be sure it's really the same person). Then unban. You can
also do what I did, and just use the reset link yourself as an admin to
make a temp password, unban, then tell the person to try resetting the
password again.

For some stats on how common this scenario may be:

irb(main):004:0> User.where(crypted_password: nil).count
=> 1672
irb(main):005:0> User.where(crypted_password: nil, status: 0).count
=> 1619

Many are real users I recognize.

I'm further refining the list to only those who have ever logged in; this
will take a bit. I can unban the whole list if it looks to remove enough
spam accounts; 1600 is not so many accounts.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/publiclab/plots2/issues/5303#issuecomment-483365906,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AH8hxXP-SGC3mFtkx-I6j6DHI9YJ6yVCks5vhMT5gaJpZM4cSP8U
.

[jywarren]

I've tried hard to find a way to distinguish spam accounts, but couldn't. I did notice about 820 were made long long before the rest, so I just batch unbanned all 820; there was a high incidence of usernames I knew, and I think any attempts to spam would've been long since passed. There are, i believe, some real users among the remaining banned set of ~800, but we can now unban them using the profile buttons. (and they can reset their pwds) So just be aware and we can probably close this now. I wish there were a more satisfying way to do this!

[jywarren]

Thanks, all!