Server settings → Plugins: uploading, cancelling or confirming a package deletes every other session's waiting package #485

New issue

Closed

opened 2026-10-01 10:47:01 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 10:47:01 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the plugin upload and confirmation flow.

Checked again on 2026-10-01 against main at 0a5cad587: still present. The code is now at core/server_views.py:1331-1335 (_upload), core/server_views.py:1363-1367 (_cancel), core/server_views.py:1392-1394 (the finally of _confirm) and core/server_views.py:927-933 (_pending_dir()).

An uploaded wheel waits in one scratch directory shared by the whole instance, plugins_dir()/.pending, under a name made from a token kept in the uploader's session. Uploading, cancelling and confirming each remove that whole directory rather than the session's own file, so one administrator's action throws away the package another administrator is still reviewing.

Where: core/server_views.py:1330-1334, PluginActionView._upload, which runs shutil.rmtree(scratch, ignore_errors=True) before writing scratch / f"{token}.whl"; core/server_views.py:1362-1366, _cancel, and core/server_views.py:1391-1393, the finally of _confirm, both of which run shutil.rmtree(_pending_dir(), ignore_errors=True). The directory is defined by _pending_dir() at core/server_views.py:926-932.
What happens: two administrators each upload a package and are reading its confirmation card (entry points, licence, dependencies). One of them presses Install, presses Cancel, or uploads another package. The other then presses Install and is told "That package is no longer waiting; upload it again", although nothing they did cancelled it.
Why it matters: the confirmation step is where a person reads what a package will run before it runs; having it disappear under them for a reason they cannot see makes the flow unreliable on an instance with more than one administrator. It needs two administrators working at once, so it is rare.
Fix: remove only the file the session owns: in _cancel and _confirm, (_pending_dir() / f"{token}.whl").unlink(missing_ok=True) for the session's token; in _upload, remove the session's previous pending file, if any, instead of the directory. Keep a sweep for abandoned files, but by age (for example anything older than a day) rather than by wiping the directory.

Done when

A test beside the plugin page's tests (tests/test_server_settings.py or the file that holds them) uploads a package as one administrator, uploads and cancels another as a second administrator in a separate client, and then confirms the first one successfully. It fails today.

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the plugin upload and confirmation flow. Checked again on 2026-10-01 against `main` at `0a5cad587`: still present. The code is now at `core/server_views.py:1331-1335` (`_upload`), `core/server_views.py:1363-1367` (`_cancel`), `core/server_views.py:1392-1394` (the `finally` of `_confirm`) and `core/server_views.py:927-933` (`_pending_dir()`). An uploaded wheel waits in one scratch directory shared by the whole instance, `plugins_dir()/.pending`, under a name made from a token kept in the uploader's session. Uploading, cancelling and confirming each remove that whole directory rather than the session's own file, so one administrator's action throws away the package another administrator is still reviewing. - **Where:** `core/server_views.py:1330-1334`, `PluginActionView._upload`, which runs `shutil.rmtree(scratch, ignore_errors=True)` before writing `scratch / f"{token}.whl"`; `core/server_views.py:1362-1366`, `_cancel`, and `core/server_views.py:1391-1393`, the `finally` of `_confirm`, both of which run `shutil.rmtree(_pending_dir(), ignore_errors=True)`. The directory is defined by `_pending_dir()` at `core/server_views.py:926-932`. - **What happens:** two administrators each upload a package and are reading its confirmation card (entry points, licence, dependencies). One of them presses Install, presses Cancel, or uploads another package. The other then presses Install and is told "That package is no longer waiting; upload it again", although nothing they did cancelled it. - **Why it matters:** the confirmation step is where a person reads what a package will run before it runs; having it disappear under them for a reason they cannot see makes the flow unreliable on an instance with more than one administrator. It needs two administrators working at once, so it is rare. - **Fix:** remove only the file the session owns: in `_cancel` and `_confirm`, `(_pending_dir() / f"{token}.whl").unlink(missing_ok=True)` for the session's token; in `_upload`, remove the session's previous pending file, if any, instead of the directory. Keep a sweep for abandoned files, but by age (for example anything older than a day) rather than by wiping the directory. ## Done when - A test beside the plugin page's tests (`tests/test_server_settings.py` or the file that holds them) uploads a package as one administrator, uploads and cancels another as a second administrator in a separate client, and then confirms the first one successfully. It fails today.

tiagoagueda added this to the 0.6.0 milestone

2026-10-01 10:47:01 +00:00

tiagoagueda added the

tier

bug

labels

2026-10-01 10:47:01 +00:00

tiagoagueda referenced this issue from a commit

2026-10-04 01:08:56 +00:00

Plugin upload: remove only the package the session owns

tiagoagueda closed this issue

2026-10-04 01:08:56 +00:00