rdiffweb 7.1.1__tar.gz → 7.2.0b2__tar.gz

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/CHANGELOG.md

@@ -445,7 +445,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Fixed
 
 - Fix exception raised for invalid locale identifier ([17c6d10](https://gitlab.com/ikus-soft/rdiffweb/commit/17c6d10a5a50d46218649c708a030e6f43d6620e) by Patrik Dufresne).
-- Fix token impersonation vulnerability ([4ce35fc](https://gitlab.com/ikus-soft/rdiffweb/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3) by Patrik Dufresne).
+- Fix token impersonation vulnerability CVE-2025-67796 ([4ce35fc](https://gitlab.com/ikus-soft/rdiffweb/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3) by Patrik Dufresne).
 - Fix selenium execution with bookworm ([1fd8db3](https://gitlab.com/ikus-soft/rdiffweb/commit/1fd8db32b9eb738168f5b1b126f020652674be9d) by Patrik Dufresne).
 - Fix doc upload #337 ([6d7219b](https://gitlab.com/ikus-soft/rdiffweb/commit/6d7219bd4348ad28e1704a4d708111751151fddc) by Patrik Dufresne).
 

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 7.1.1
+Version: 7.2.0b2
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE
@@ -691,7 +691,7 @@ Classifier: Framework :: CherryPy
 Requires-Python: <4,>=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cherrypy-foundation<2,>=1.14.0
+Requires-Dist: cherrypy-foundation<2,>=1.18.0
 Requires-Dist: cherrypy-foundation[ldap]
 Requires-Dist: cherrypy-foundation[oauth]
 Requires-Dist: cherrypy-foundation[passwd]
@@ -727,7 +727,7 @@ Dynamic: license-file
 <strong>
 <a href="https://www.rdiffweb.org">website</a>
 • <a href="https://www.ikus-soft.com/archive/rdiffweb/doc/latest/html/">docs</a>
-• <a href="https://groups.google.com/d/forum/rdiffweb">community</a>
+• <a href="https://minarca.discourse.group/">community</a>
 • <a href="https://rdiffweb-demo.ikus-soft.com/">demo</a>
 </strong>
 </p>
@@ -823,11 +823,11 @@ By signing up for, you will receive regular updates and notifications about new
 
 [Rdiffweb Newsletter](https://rdiffweb.org/contactus).
 
-## Google Group
+## Community
 
 Join our growing community to get answers to your technical questions.
 
-Rdiffweb users should use the [Rdiffweb Google Group](https://groups.google.com/forum/#!forum/rdiffweb).
+Rdiffweb users should use the [Discourse Group](https://minarca.discourse.group/).
 
 ## Documentation
 

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/README.md

@@ -4,7 +4,7 @@
 <strong>
 <a href="https://www.rdiffweb.org">website</a>
 • <a href="https://www.ikus-soft.com/archive/rdiffweb/doc/latest/html/">docs</a>
-• <a href="https://groups.google.com/d/forum/rdiffweb">community</a>
+• <a href="https://minarca.discourse.group/">community</a>
 • <a href="https://rdiffweb-demo.ikus-soft.com/">demo</a>
 </strong>
 </p>
@@ -100,11 +100,11 @@ By signing up for, you will receive regular updates and notifications about new
 
 [Rdiffweb Newsletter](https://rdiffweb.org/contactus).
 
-## Google Group
+## Community
 
 Join our growing community to get answers to your technical questions.
 
-Rdiffweb users should use the [Rdiffweb Google Group](https://groups.google.com/forum/#!forum/rdiffweb).
+Rdiffweb users should use the [Discourse Group](https://minarca.discourse.group/).
 
 ## Documentation
 

rdiffweb-7.2.0b2/SECURITY.md

@@ -0,0 +1,33 @@
+# Reporting a Vulnerability
+
+If you discover a security vulnerability in Rdiffweb, please report it privately through GitLab:
+
+1. Open a **[New Confidential Issue](https://gitlab.com/ikus-soft/rdiffweb/-/issues/new?issue%5Bconfidential%5D=true)**.
+2. Make sure the **"This issue is confidential"** checkbox is checked.
+3. Include the affected version, description, and steps to reproduce (PoC).
+
+Thank you for improving the security of Rdiffweb.
+
+## Non-qualifying reports
+
+The following are generally **not** considered security vulnerabilities. Please do not report them as such;
+open a regular (public) issue or merge request instead if you believe they are worth improving.
+
+- **Content Security Policy (CSP) configuration**: Use of `unsafe-inline` or `unsafe-eval`, or any other
+  permissive or missing CSP directive, without a working exploit that does not depend on the CSP itself.
+  CSP is a defense-in-depth layer, not Rdiffweb's primary protection against XSS. Rdiffweb's web interface
+  currently relies on inline scripts and styles.
+- **Weak TLS / SSL configuration**: TLS is expected to be terminated by the reverse proxy.
+- **Clickjacking** without a demonstrated impact on a sensitive action.
+- **Self-XSS**, or XSS requiring the victim to paste code into their own browser console.
+- **XSS or content injection by administrators**: administrators are trusted by design.
+- **Unsupported browsers**: issues that only affect outdated browsers or require relaxed browser security settings.
+- **Vulnerabilities in third-party dependencies** without a demonstrated exploit path in Rdiffweb.
+- **Findings from automated scanners** submitted without manual verification and a working proof of concept.
+- **Misconfiguration of a deployment** (reverse proxy, OS, container) outside Rdiffweb's default configuration.
+- **Code paths unreachable in a supported installation**: weaknesses that only occur when a declared
+  dependency is missing, removed, or deliberately bypassed (e.g. `--no-deps`), or in an environment that
+  Rdiffweb does not support. A report must demonstrate that the issue is reachable in a default,
+  supported installation.
+
+Reports in these categories may be closed without a detailed response.

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Framework :: CherryPy"
 ]
 dependencies = [
-    "cherrypy-foundation>=1.14.0,<2",
+    "cherrypy-foundation>=1.18.0,<2",
     "cherrypy-foundation[ldap]",
     "cherrypy-foundation[oauth]",
     "cherrypy-foundation[passwd]",

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/components/RdwMessages.jinja

@@ -42,14 +42,15 @@
     {% trans %}Event{% endtrans %}
   </span>
 {% endset %}
-{% set reset_btn = {'text': _('Reset Filters'), 'extend': 'reset', 'className':'btn-secondary ms-3'} %}
+{% set spacer_btn = {"extend": "spacer"} %}
+{% set reset_btn = {'text': _('Reset Filters'), 'extend': 'reset', 'className':'btn-secondary'} %}
 {% set new_type = {'text': _('Creations'), 'extend': 'filter', 'column': 'type:name', 'search':'new', 'regex': False, 'className':'btn-outline-secondary'} %}
 {% set dirty_type = {'text': _('Modifications'), 'extend': 'filter', 'column': 'type:name', 'search':'dirty', 'className':'btn-outline-secondary'} %}
 {% set comment_type = {'text': _('Comments'), 'extend': 'filter', 'column': 'type:name', 'search':'comment', 'className':'btn-outline-secondary'} %}
 {% set event_type = {'text': _('Events'), 'extend': 'filter', 'column': 'type:name', 'search':'event', 'className':'btn-outline-secondary'} %}
 {% set delete_type = {'text': _('Deletions'), 'extend': 'filter', 'column': 'type:name', 'search':'deleted', 'className':'btn-outline-secondary'} %}
 {% if show in ['repo', 'user'] %}
-  {% set buttons = [new_type, dirty_type, comment_type, event_type, delete_type, reset_btn] %}
+  {% set buttons = [new_type, dirty_type, comment_type, event_type, delete_type, spacer_btn, reset_btn] %}
   {% set columns = [
       {'name':'date', 'data':'date', 'title':_('Date'), 'render':'datetime'},
       {'name':'author', 'data':'author_username', 'title':_('Actor'), 'orderable':True, 'render':'actor'},
@@ -58,8 +59,9 @@
     ] %}
 {% else %}
   {% set buttons = [new_type, dirty_type, comment_type, event_type, delete_type,
-      {'text': _('Users'), 'extend': 'filter', 'column': 'model_name:name', 'search':'user', 'className':'ms-3 btn-outline-primary'},
-      {'text': _('Repositories'), 'extend': 'filter', 'column': 'model_name:name', 'search':'repo', 'className':'btn-outline-primary'},
+      {'text': _('Users'), 'extend': 'filter', 'column': 'model_name:name', 'search':'user', 'className':'ms-3 btn-outline-secondary'},
+      {'text': _('Repositories'), 'extend': 'filter', 'column': 'model_name:name', 'search':'repo', 'className':'btn-outline-secondary'},
+      spacer_btn,
       reset_btn
     ] %}
   {% set columns = [

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/components/RdwTable.css

@@ -15,9 +15,17 @@
   width: 100%;
   color: var(--bs-body-color) !important;
   background-color: var(--bs-body-bg) !important;
-  min-width: 25vw;
   padding:0 !important;
 }
+/* If the row is too long, make it wrap. */
+.rdw-table .dt-layout-row {
+  flex-wrap: wrap;
+}
+/* Add margin arround buttons when content is wrapping. */
+.rdw-table .dt-buttons .btn.btn-sm  {
+  margin-top: 3px;
+  margin-bottom: 3px;
+}
 
 /* Hide search label */
 .rdw-table .dt-search label {

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/components/RepoCard.jinja

@@ -28,7 +28,7 @@
       {# Backup count #}
       <div class="col-6">
         <div class="bg-light rounded-3 p-2">
-          <div class="fw-bold text-truncate">{{ repo.session_statistics | length if repo.session_statistics else mdash }}</div>
+          <div class="fw-bold text-truncate">{{ repo.backup_count or mdash }}</div>
           <div class="text-muted" style="font-size:.72rem">{% trans %}Restore points{% endtrans %}</div>
         </div>
       </div>
@@ -39,25 +39,22 @@
         <RdwIcon value="bi-calendar-range" class="me-1" />
         {%- trans %}Oldest:{% endtrans %}
         <strong>
-          <RdwTime :value="repo.session_statistics and repo.session_statistics[0].date" format="short" />
+          <RdwTime :value="repo.first_backup_date" format="short" />
         </strong>
       </span>
       {# Error count #}
       <span class="text-muted small">
-        {% if repo.session_statistics %}
-          {% set error_count = repo.session_statistics[-1].errors %}
-          {% if error_count > 0 %}
-            <a class="text-danger-emphasis fw-semibold"
-               href="{{ url_for('logs', repo, date=repo.session_statistics[-1].date) }}">
-              <RdwIcon value="bi-exclamation-circle" class="me-1" />
-              {{- _('%(count)s errors', count=error_count) }}
-            </a>
-          {% else %}
-            <RdwIcon value="bi-check-circle" class="text-success" class="me-1" />
-            {{- _('%(count)s errors', count=error_count) }}
-          {% endif %}
-        {% else %}
+        {% if repo.last_error_count is none %}
           {{ mdash }}
+        {% elif repo.last_error_date %}
+          <a class="text-danger-emphasis fw-semibold"
+             href="{{ url_for('logs', repo, date=repo.last_error_date) }}">
+            <RdwIcon value="bi-exclamation-circle" class="me-1" />
+            {{- _('%(count)s errors', count=repo.last_error_count) }}
+          </a>
+        {% else %}
+          <RdwIcon value="bi-check-circle" class="text-success" class="me-1" />
+          {{- _('%(count)s errors', count=repo.last_error_count) }}
         {% endif %}
       </span>
     </div>

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/controller/page_admin_repos.py

@@ -27,6 +27,8 @@ class AdminReposPage:
         """
         Show all user repositories
         """
+        repo_objs = RepoObject.query.all()
+        RepoObject.attach_statistics_info(repo_objs)
         return {
-            "repos": RepoObject.query.all(),
+            "repos": repo_objs,
         }

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/controller/page_home.py

@@ -23,7 +23,7 @@ from cherrypy_foundation.tools.i18n import gettext_lazy as _
 from cherrypy_foundation.url import url_for
 
 from rdiffweb.core.librdiff import RdiffTime
-from rdiffweb.core.model import DiskUsage, UserObject
+from rdiffweb.core.model import DiskUsage, RepoObject, UserObject
 
 # Define the logger
 logger = logging.getLogger(__name__)
@@ -68,6 +68,7 @@ class HomePage:
 
         # Add disk usage to repos.
         repo_objs = DiskUsage.attach_disk_usage(repo_objs)
+        repo_objs = RepoObject.attach_statistics_info(repo_objs)
 
         activity_end = RdiffTime()
         activity_start = RdiffTime() - timedelta(days=30)
@@ -82,7 +83,7 @@ class HomePage:
             "total_interrupted": status_counts["interrupted"],
             "total_in_progress": status_counts["in_progress"],
             # Errors
-            "error_count": sum(r.session_statistics[-1].errors for r in repo_objs if r.last_backup_date),
+            "total_error_count": sum(r.last_error_count for r in repo_objs if r.last_error_count),
             # last_backup
             "last_backup_date": last_backup.last_backup_date if last_backup else None,
             "last_backup_repo": last_backup.display_name if last_backup else None,

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/controller/tests/test_controller.py

@@ -86,6 +86,11 @@ class ControllerTest(rdiffweb.test.WebCase):
         self.getPage('/static//../../test.js')
         self.assertStatus(403)
 
+    def test_dt_language(self):
+        for locale in ['en', 'fr', 'fr_CA']:
+            self.getPage(f'/static/dt-language/{locale}')
+            self.assertStatus(200)
+
 
 class ControllerExternalUrlTest(rdiffweb.test.WebCase):
     default_config = {'external_url': 'https://www.example.com'}

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/controller/tests/test_page_history.py

@@ -15,6 +15,7 @@
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 import os
+from pathlib import Path
 
 import cherrypy
 from selenium.webdriver.common.action_chains import ActionChains
@@ -35,6 +36,37 @@ class HistoryPageTest(rdiffweb.test.WebCase):
         self.getPage(url)
         self.assertStatus('200 OK')
 
+    def test_history_path_traversal(self):
+        # Given a user with single repo
+        user = UserObject.get_user(self.USERNAME)
+        (Path(self.testcases) / 'broker-repo').rename(Path(self.testcases) / 'testcases-secret')
+        user.refresh_repos(delete=True)
+        user.commit()
+        self.assertEqual(['testcases', 'testcases-secret'], [r.name for r in user.repo_objs])
+        # When browsing /history/user/test/../testing
+        self.getPage('/history/admin/testcases/%2e%2e/testcases-secret')
+        # Then an error should be raised.
+        self.assertStatus(403)
+
+    def test_history_with_single_repo(self):
+        """
+        Verify if browsing '/history/' for a single repository is working.
+        """
+        # Change the user setting to match single repo.
+        user = UserObject.get_user(self.USERNAME)
+        user.user_root = os.path.join(self.testcases, 'testcases')
+        user.refresh_repos(delete=True)
+        user.commit()
+        self.assertEqual([''], [r.name for r in user.repo_objs])
+        # Check if browsing is working.
+        self.getPage('/history/admin')
+        self.assertStatus('200 OK')
+        self.assertInBody('Files')
+        # Check sub directory browsing
+        self.getPage('/history/admin/Revisions/')
+        self.assertStatus('200 OK')
+        self.assertInBody('Files')
+
     def test_history_with_root(self):
         self._history(self.USERNAME, self.REPO, limit=10)
         # Check revisions

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/controller/tests/test_page_login.py

@@ -90,6 +90,7 @@ class LoginPageTest(rdiffweb.test.WebCase):
         cherrypy.scheduler.wait_for_jobs()
         user = UserObject.get_user(self.USERNAME)
         self.assertEqual("User login to web application", user.messages[-1].body)
+        self.assertEqual(userobj.id, user.messages[-1].author_id)
 
     def test_login_case_insensitive(self):
         # When authenticating with valid credentials with all uppercase username

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/core/librdiff.py

@@ -53,6 +53,16 @@ STDOUT_ENCODING = 'utf-8'
 LANG = "en_US." + STDOUT_ENCODING
 
 
+def _is_child_of(child, parent):
+    """
+    Return True if the child is relative to parent path or False.
+    This method is string-based.
+    """
+    child = os.path.normpath(child)
+    parent = os.path.normpath(parent)
+    return child == parent or child.startswith(parent.rstrip(b'/') + b'/')
+
+
 def rdiff_backup_version():
     """
     Get rdiff-backup version
@@ -996,9 +1006,9 @@ class RdiffRepo(object):
         """Return a new instance of DirEntry to represent the given path."""
         # Compute increment directory location.
         assert isinstance(path, bytes)
-        full_path = os.path.normpath(os.path.join(self.full_path, path.strip(b'/')))
-        increment_path = os.path.normpath(os.path.join(self._increment_path, path.strip(b'/'), b'..'))
-        if not full_path.startswith(self.full_path) or not increment_path.startswith(self.full_path):
+        full_path = os.path.join(self.full_path, path.strip(b'/'))
+        increment_path = os.path.dirname(os.path.join(self._increment_path, path.strip(b'/')))
+        if not _is_child_of(full_path, self.full_path) or not _is_child_of(increment_path, self.full_path):
             raise AccessDeniedError('%s make reference outside the repository' % self._decode(path))
         relative_path = os.path.relpath(full_path, self.full_path)
         if relative_path.startswith(RDIFF_BACKUP_DATA):

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/core/model/_callbacks.py

@@ -19,6 +19,8 @@ from sqlalchemy.orm import Session
 
 
 def add_post_commit_tasks(session, *args):
+    if getattr(session, '_trans_context_manager', False):
+        raise RuntimeError('cannot use add_post_commit_tasks with sql context manager')
     # Add task
     session.info.setdefault("_after_commit_tasks", []).append(args)
 

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/core/model/_message.py

@@ -14,9 +14,12 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+import contextvars
 import itertools
 import json
 import logging
+from collections import namedtuple
+from contextlib import contextmanager
 
 import cherrypy
 import cherrypy_foundation.plugins.db  # noqa
@@ -64,6 +67,35 @@ class JSONString(TypeDecorator):
             return None
 
 
+class _MessageContext(
+    namedtuple('_MessageContext', ['author', 'author_id', 'author_username', 'ip_address', 'user_agent'])
+):
+
+    def __new__(cls, author=None, author_id=None, author_username='', ip_address='', user_agent=''):
+        # Derive id/username from the author when one is provided.
+        if author is not None:
+            author_id = author.id
+            author_username = author.username
+        return super().__new__(cls, author, author_id, author_username, ip_address, user_agent)
+
+    def _replace(self, **kwds):
+        if 'author' in kwds and kwds['author'] is not None:
+            kwds.setdefault('author_id', kwds['author'].id)
+            kwds.setdefault('author_username', kwds['author'].username)
+        return super()._replace(**kwds)
+
+    @contextmanager
+    def use(self):
+        ctx = (
+            self._replace(author=None) if self.author and inspect(self.author).session != cherrypy.db.session else self
+        )
+        token = Message._context_var.set(ctx)
+        try:
+            yield self
+        finally:
+            Message._context_var.reset(token)
+
+
 def get_model_changes(model):
     """
     Return a dictionary containing changes made to the model since it was
@@ -142,12 +174,14 @@ class Message(Base):
     changes = Column('changes', JSONString, nullable=True)
     date = Column(Timestamp(timezone=True), default=func.now())
 
+    _context_var = contextvars.ContextVar('message_context', default=None)
+
     def __init__(self, **kwargs):
         """
         Called only when creating a NEW instance, not when loading from DB.
         """
         super().__init__(**kwargs)
-        self._initialize_from_session()
+        self._initialize_from_context()
 
     @property
     def model_object(self):
@@ -164,26 +198,57 @@ class Message(Base):
             self.author_username = value.username
         return value
 
-    def _initialize_from_session(self):
-        """Populate fields from the current CherryPy session/request."""
-        request = cherrypy.request
-        try:
-            if not self.author:
-                self.author = request.currentuser
-        except AttributeError:
-            pass  # No active request/user
-
-        try:
-            if not self.ip_address:
-                self.ip_address = request.remote.ip or ''
-        except AttributeError:
-            pass
+    def _initialize_from_context(self):
+        """
+        Populate fields from the current execution context: either the live
+        CherryPy request (the common case), or a propagated ExecutionContext
+        installed via `copy_context()` in a background thread.
+        """
+        ctx = Message._current_context()
+        if not self.author and ctx.author is not None:
+            self.author = ctx.author
+        if not self.author_id and ctx.author_id:
+            self.author_id = ctx.author_id
+        if not self.author_username and ctx.author_username:
+            self.author_username = ctx.author_username
+        if not self.ip_address and ctx.ip_address:
+            self.ip_address = ctx.ip_address
+        if not self.user_agent and ctx.user_agent:
+            self.user_agent = ctx.user_agent
+
+    @staticmethod
+    def capture_context():
+        """
+        Capture author/ip/user-agent from the current CherryPy request.
+        Call this from the HTTP thread before scheduling background work.
+        Returns a context-manager-capable object; use it with `.use()`.
+        """
+        request = getattr(cherrypy, 'request', None)
+        author = getattr(request, 'currentuser', None) if request else None
+        author_id = getattr(author, 'id', None) if author else None
+        author_username = getattr(author, 'username', None) if author else None
+        ip_address = ''
+        user_agent = ''
+        if request is not None:
+            try:
+                ip_address = request.remote.ip or ''
+            except AttributeError:
+                pass
+            try:
+                user_agent = request.headers.get('User-Agent', '')
+            except AttributeError:
+                pass
+        return _MessageContext(
+            author=author,
+            author_id=author_id,
+            author_username=author_username,
+            ip_address=ip_address,
+            user_agent=user_agent,
+        )
 
-        try:
-            if not self.user_agent:
-                self.user_agent = request.headers.get('User-Agent', '')
-        except AttributeError:
-            pass
+    @classmethod
+    def _current_context(cls):
+        return cls._context_var.get() or cls.capture_context()
 
 
 class MessageMixin:

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/core/model/_repo.py

@@ -192,6 +192,29 @@ class RepoObject(MessageMixin, Base, RdiffRepo):
         except ValueError:
             raise DoesNotExistError(path)
 
+    @classmethod
+    def attach_statistics_info(cls, repo_objs):
+        for repo in repo_objs:
+            try:
+                stats = repo.session_statistics
+            except Exception:
+                cherrypy.log('unexpected error trying to get session_statistics', traceback=True)
+                stats = None
+
+            if stats:
+                repo.last_error_count = stats[-1].errors
+                repo.last_error_date = stats[-1].date
+                repo.last_filesize = stats[-1].sourcefilesize
+                repo.first_backup_date = stats[0].date
+                repo.backup_count = len(stats)
+            else:
+                repo.last_error_count = None
+                repo.last_error_date = None
+                repo.last_filesize = None
+                repo.first_backup_date = None
+                repo.backup_count = 0
+        return repo_objs
+
     def __init__(self, *args, **kwargs):
         Base.__init__(self, *args, **kwargs)
         self.__init_on_load__()

{rdiffweb-7.1.1 → rdiffweb-7.2.0b2}/rdiffweb/core/model/_user.py

@@ -21,6 +21,7 @@ import sys
 
 import cherrypy
 from cherrypy_foundation.passwd import check_password, hash_password
+from cherrypy_foundation.tools.i18n import gettext
 from cherrypy_foundation.tools.i18n import gettext_lazy as _
 from sqlalchemy import (
     Boolean,
@@ -42,7 +43,7 @@ from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import Session, relationship, validates
 
 from ._callbacks import add_post_commit_tasks
-from ._message import AUDIT_IGNORE, MessageMixin, get_model_changes
+from ._message import AUDIT_IGNORE, Message, MessageMixin, get_model_changes
 from ._repo import RepoObject
 from ._session import SessionObject
 from ._sshkey import SshKey
@@ -81,22 +82,38 @@ Base = cherrypy.db.base
 SEP = b'/'
 
 
-def delete_user_with_data(userid):
+def delete_user_with_data(userid, ctx):
     """
     Job to delete user with all data.
     """
-    cherrypy.db.clear_sessions()
-    with cherrypy.db.session.begin():
-        # Let start by deleting all repositories from disk.
+    try:
         userobj = UserObject.get_user(userid)
         username = userobj.username
-        logger.info('deleting user [%s] with data', username)
-        for repoobj in userobj.repo_objs:
-            logger.info('deleting repository [%s]', repoobj.display_name)
-            repoobj.delete_repo()
-        # Finish by deleting the user it self.
-        userobj.delete()
-        logger.info('user [%s] deleted', username)
+    except Exception:
+        logger.warning("deleting user id [%s] failed", userid, exc_info=True)
+        UserObject.session.rollback()
+        raise
+
+    try:
+        with ctx.use():
+            # Let start by deleting all repositories from disk.
+            logger.info('deleting user [%s] with data', username)
+            for repoobj in userobj.repo_objs:
+                logger.info('deleting repository [%s]', repoobj.display_name)
+                repoobj.delete_repo()
+                repoobj.commit()
+            # Finish by deleting the user it self.
+            userobj.delete()
+            userobj.commit()
+            logger.info('user [%s] deleted', username)
+    except Exception:
+        logger.warning("deleting user [%s] failed", username, exc_info=True)
+        UserObject.session.rollback()
+        userobj.add_message(Message(body=gettext("Deletion of user failed"), type=Message.TYPE_EVENT))
+        userobj.commit()
+        raise
+    finally:
+        UserObject.session.rollback()
 
 
 class UserObject(MessageMixin, Base):
@@ -362,11 +379,16 @@ class UserObject(MessageMixin, Base):
             raise ValueError(_("can't delete admin user"))
         if delete_data:
             self.status = UserObject.STATUS_DELETING
+            self.add_message(Message(body=gettext("Deletion of user has been scheduled."), type=Message.TYPE_EVENT))
             for repoobj in self.repo_objs:
+                repoobj.add_message(
+                    Message(body=gettext("Deletion of repository has been scheduled."), type=Message.TYPE_EVENT)
+                )
                 repoobj._status = RepoObject.STATUS_DELETING
-            add_post_commit_tasks(self.session, 'scheduler:add_job_now', delete_user_with_data, self.id)
+            ctx = Message.capture_context()
+            add_post_commit_tasks(self.session, 'scheduler:add_job_now', delete_user_with_data, self.id, ctx)
         else:
-            # Otherwise, let delete use directly.
+            # Otherwise, let delete user directly.
             return Base.delete(self)
 
     def delete(self):