by Sharif Mehedi · in Developers · assigned to Sharif Mehedi

Kokkuvõte

Children

Kommentaarid

• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I created a new demo project noi4 for testing user deletion. The test case is far from being exhaustive, but it's a beginning.
• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I started writing a unit testcase with Sharif, then continued alone. Still thinking about where to put it. I want a rather minimal demo project, but with uploads (because I want to verify that Lino deletes them after the delay).
• 7 kuud, 2 nädalat ago by Sharif Mehedi in reply to Luc Saffre about #6641 (User deletion form (ForgetMe action)) : We should probably remove it from publisher.
• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I pushed my changes in lino and xl. The test suite passed, but there is more to do.
• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Maybe the ForgetMe action should not even sign out the user. It just sets the timestamp.
• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) (1 reply) : Can't we remove the ForgetMe link in the publisher interface? It looks a bit silly in such an exposed place.
• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Together with @8lurry on Jitsi I started a series of code changes to optimize this. It's not finished, but we'll try to continue on it together.
• 7 kuud, 2 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : TODO in User.on_forget(): lino.modlib.users must not try to know what other plugins do (contacts, vat, peppol). Instead of saying forgettable_partner_fields.update(...), say forgettable_fields = self.get_forgettable_fields(). Similar remark for modifying User.person or User.company.
• 7 kuud, 3 nädalat ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : How to invalidate other active session from user's other devices when forgetme executes.
• 7 kuud, 3 nädalat ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : I pushed some changes to different repositories related to ForgetMe action. Please pull these changes.
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : What should ForgetMe do? Actually it would just logout and deactivate the user (set_invalid_password(), set end_date to today), set forget_me_since to ar.now()). And a model mixin user.Forgettable with a method get_forgettable_data() which for uploads would return a queryset of the database rows hav...
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I created a separate ticket for this: #6642 (Open the sign-in dialog when anonymous asks for an URL that requires auth)
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Looking at the diff I don't like this solution because it requires the caller (config/bootstrap5/base.html) to decide whether a sign in is needed. I'd prefer it as a general feature: whenever a link that requires authentication is requested by anonymous, the front-end should automatically open a sig...
• 7 kuud, 3 nädalat ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : I have implemented recursive action support in react. it can now run one action after the other.
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : @8lurry and i had a jitsi session and advanced a bit. Now blurry takes the ball for a while. We "only" need the front end to open the sign-in dialog when an anonymous request asks for the forget_me action...
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Yesterday together we made a ForgetMe action that works when you're signed in, but we still need a static link tha works for anonymous.
• 7 kuud, 3 nädalat ago by Luc Saffre in reply to Luc Saffre about #6641 (User deletion form (ForgetMe action)) : "the European Court of Justice legally solidified that the "right to be forgotten" is a human right when they ruled against Google in the Costeja case on May 13, 2014." (en.wikipedia.org/wiki/Right_to_be_forgotten)
  
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : The deletion form is technically the same as the verification form. It could ask the user to enter their password (just to protect against accidental deletion) and if the password is correct, ask another confirmation, and then clear the account.
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : The deletion form won't be a webform. it can be a link to the admin interface. But need to make sure that such a link should open a sign-in form if the user is!t yet authenticated.
• 7 kuud, 3 nädalat ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) (1 reply) : Makes sense. EU laws require this too. Humans must have the "right to become forgotten". AFAIK this doesn't necessarily mean to delete the user account. It's maybe enough to set username, names, email etc to blank and to mark the account as deleted. I don't think that we are required to merge all de...
• 7 kuud, 3 nädalat ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : Google play console requires a url pointing to a user deletion form since we have user registration feature.
• 7 kuud, 3 nädalat ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : Created new Ticket #6641 (User deletion form).