RFC re: 798960 -- session timeout-induced bug

Mo Morsi mmorsi at redhat.com
Thu Mar 1 23:11:22 UTC 2012


On 03/01/2012 05:48 PM, Hugh Brock wrote:
> Hmmm... Problem is not timing out is a security hole. Is this anything more serious than a change to rails config? 
>
> -h
>
> Matt Wagner <matt.wagner at redhat.com> wrote:
>
> Hi folks,
>
> The other day, https://bugzilla.redhat.com/show_bug.cgi?id=794536 was
> entered -- "conductor should have an inactivity timeout."
>
> I only noticed it after it was pushed, and I remarked on IRC that it
> sounded more like an irritant than a good feature. Further, I suggested
> that it was a new feature, not a bug, so it didn't belong in this
> sprint. It sounded like there was some consensus on at least the second
> point, but more in a "going forward" sense than in relation to this
> specific bugfix.
>
> I just noticed https://bugzilla.redhat.com/show_bug.cgi?id=798960 as I
> was packing up for the day, which is marked as an urgent bug that is
> wreaking havoc on QE. While it's a legitimate bug, it seems like it's
> directly caused by the patch in #794536.
>
> At the risk of sounding like a curmudgeon, I would propose that we
> should revert the patch for 794536. The patch itself was good, but its
> inclusion was out-of-scope for the sprint, and it's now causing a
> high-priority bug.
>
> Thoughts?
>
> -- Matt

Hrm why is the inactivity timeout causing issues w/ QE? Do any of the
automated tests incorporate a delay > 15 minutes?

Regardless, would tailoring the behaviour to the rails environment solve
the issue? eg. when running the app in 'production' we incorporate this
time out where as it is disabled in the 'test' environment.

    -Mo





More information about the aeolus-devel mailing list