Project

General

Profile

Actions

Bug #39447

open

Run search queries for certain host bulk actions dangerous

Added by Bernhard Suttner about 2 months ago. Updated about 2 months ago.

Status:
Ready For Testing
Priority:
Normal
Category:
-
Target version:
-
Difficulty:
Triaged:
No
Fixed in Releases:
Found in Releases:

Description

Bulk host actions on the new Hosts page can execute against a different host scope than the one the user originally selected.

When a user uses Select all on /new/hosts and later runs a dangerous bulk action such as delete or change power state, the action is re-evaluated from the current live scope instead of a fixed host set. This can lead to unintended changes if the visible scope changes between selection time and execution time. Additionally, the user gets the messsage how many hosts are affected by the query - but this amount may be wrong if there are already changes from e.g. other users.

Examples:

- The user opens the Hosts page in organization Org 1, selects all hosts, but before confirming the bulk action another browser tab changes the active taxonomy to All. The confirmation dialog still reflects the old page state, but the final action can run against a broader scope.
- The user selects all hosts at time X, another user adds or removes hosts at time X+1, and the original user confirms the bulk action later. The final action can then target a different set of hosts than the user saw when making the selection.

This is especially risky for destructive or disruptive bulk actions:
- delete
- build
- disassociate
- change power state

Actions #1

Updated by The Foreman Bot about 2 months ago

  • Status changed from New to Ready For Testing
  • Assignee set to Bernhard Suttner
  • Pull request https://github.com/theforeman/foreman/pull/11038 added
Actions

Also available in: Atom PDF