500 Error for TL0 Instagram & Youtube link posts

bug
1

So came across a weird error.

This is on a test instance, running tests-passed (error occured on both beta and tests-passed). I tried uninstalling all plugins except docker manager and removing all theme components.

I updated from Stable to Beta, then to tests-passed. A clue might be that two old posts of the regular user test account got flagged by the system after the update for posting too many references to the same domains.

When I attempt to post on the TL0 account, I can post oneboxes of Twitter and Reddit without issue. However Instagram and Youtube links will give a 500 error. If I elevate the trust level of the account to TL1, the links post fine (and if I revert it back to TL0, keeps getting 500 errors).

Also, if I add youtube and instagram to the allowed_spam_host_domains, then the 500 error disappears for the TL0 user.

Log - Info:

NoMethodError (undefined method `title' for nil:NilClass)
lib/post_action_creator.rb:264:in `create_message_creator'
lib/post_action_creator.rb:91:in `perform'
lib/post_action_creator.rb:18:in `create'
app/models/user.rb:1073:in `block in flag_linked_posts_as_spam'
app/models/user.rb:1066:in `flag_linked_posts_as_spam'
lib/new_post_manager.rb:284:in `perform_create_post'
lib/new_post_manager.rb:216:in `perform'
app/controllers/posts_controller.rb:180:in `create'
app/controllers/application_controller.rb:357:in `block in with_resolved_locale'
app/controllers/application_controller.rb:357:in `with_resolved_locale'
lib/middleware/omniauth_bypass_middleware.rb:68:in `call'
lib/content_security_policy/middleware.rb:12:in `call'
lib/middleware/anonymous_cache.rb:354:in `call'
config/initializers/100-quiet_logger.rb:23:in `call'
config/initializers/100-silence_logger.rb:31:in `call'
lib/middleware/enforce_hostname.rb:22:in `call'
lib/middleware/request_tracker.rb:176:in `call'

Log - Backtrace:

lib/post_action_creator.rb:264:in `create_message_creator'

lib/post_action_creator.rb:91:in `perform'

lib/post_action_creator.rb:18:in `create'

app/models/user.rb:1073:in `block in flag_linked_posts_as_spam'

activerecord (6.0.3.3) lib/active_record/relation/delegation.rb:87:in `each'

activerecord (6.0.3.3) lib/active_record/relation/delegation.rb:87:in `each'

app/models/user.rb:1066:in `flag_linked_posts_as_spam'

lib/new_post_manager.rb:284:in `perform_create_post'

lib/new_post_manager.rb:216:in `perform'

app/controllers/posts_controller.rb:180:in `create'

actionpack (6.0.3.3) lib/action_controller/metal/basic_implicit_render.rb:6:in `send_action'

actionpack (6.0.3.3) lib/abstract_controller/base.rb:195:in `process_action'

actionpack (6.0.3.3) lib/action_controller/metal/rendering.rb:30:in `process_action'

actionpack (6.0.3.3) lib/abstract_controller/callbacks.rb:42:in `block in process_action'

activesupport (6.0.3.3) lib/active_support/callbacks.rb:112:in `block in run_callbacks'

app/controllers/application_controller.rb:357:in `block in with_resolved_locale'

i18n (1.8.5) lib/i18n.rb:313:in `with_locale'

app/controllers/application_controller.rb:357:in `with_resolved_locale'

activesupport (6.0.3.3) lib/active_support/callbacks.rb:121:in `block in run_callbacks'

activesupport (6.0.3.3) lib/active_support/callbacks.rb:139:in `run_callbacks'

actionpack (6.0.3.3) lib/abstract_controller/callbacks.rb:41:in `process_action'

actionpack (6.0.3.3) lib/action_controller/metal/rescue.rb:22:in `process_action'

actionpack (6.0.3.3) lib/action_controller/metal/instrumentation.rb:33:in `block in process_action'

activesupport (6.0.3.3) lib/active_support/notifications.rb:180:in `block in instrument'

activesupport (6.0.3.3) lib/active_support/notifications/instrumenter.rb:24:in `instrument'

activesupport (6.0.3.3) lib/active_support/notifications.rb:180:in `instrument'

actionpack (6.0.3.3) lib/action_controller/metal/instrumentation.rb:32:in `process_action'

actionpack (6.0.3.3) lib/action_controller/metal/params_wrapper.rb:245:in `process_action'

activerecord (6.0.3.3) lib/active_record/railties/controller_runtime.rb:27:in `process_action'

actionpack (6.0.3.3) lib/abstract_controller/base.rb:136:in `process'

actionview (6.0.3.3) lib/action_view/rendering.rb:39:in `process'

rack-mini-profiler (2.2.0) lib/mini_profiler/profiling_methods.rb:85:in `block in profile_method'

actionpack (6.0.3.3) lib/action_controller/metal.rb:190:in `dispatch'

actionpack (6.0.3.3) lib/action_controller/metal.rb:254:in `dispatch'

actionpack (6.0.3.3) lib/action_dispatch/routing/route_set.rb:50:in `dispatch'

actionpack (6.0.3.3) lib/action_dispatch/routing/route_set.rb:33:in `serve'

actionpack (6.0.3.3) lib/action_dispatch/journey/router.rb:49:in `block in serve'

actionpack (6.0.3.3) lib/action_dispatch/journey/router.rb:32:in `each'

actionpack (6.0.3.3) lib/action_dispatch/journey/router.rb:32:in `serve'

actionpack (6.0.3.3) lib/action_dispatch/routing/route_set.rb:834:in `call'

lib/middleware/omniauth_bypass_middleware.rb:68:in `call'

rack (2.2.3) lib/rack/tempfile_reaper.rb:15:in `call'

rack (2.2.3) lib/rack/conditional_get.rb:40:in `call'

rack (2.2.3) lib/rack/head.rb:12:in `call'

lib/content_security_policy/middleware.rb:12:in `call'

lib/middleware/anonymous_cache.rb:354:in `call'

rack (2.2.3) lib/rack/session/abstract/id.rb:266:in `context'

rack (2.2.3) lib/rack/session/abstract/id.rb:260:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/cookies.rb:648:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'

activesupport (6.0.3.3) lib/active_support/callbacks.rb:101:in `run_callbacks'

actionpack (6.0.3.3) lib/action_dispatch/middleware/callbacks.rb:26:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/debug_exceptions.rb:32:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'

logster (2.9.4) lib/logster/middleware/reporter.rb:43:in `call'

railties (6.0.3.3) lib/rails/rack/logger.rb:37:in `call_app'

railties (6.0.3.3) lib/rails/rack/logger.rb:28:in `call'

config/initializers/100-quiet_logger.rb:23:in `call'

config/initializers/100-silence_logger.rb:31:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/remote_ip.rb:81:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/request_id.rb:27:in `call'

lib/middleware/enforce_hostname.rb:22:in `call'

rack (2.2.3) lib/rack/method_override.rb:24:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/executor.rb:14:in `call'

rack (2.2.3) lib/rack/sendfile.rb:110:in `call'

actionpack (6.0.3.3) lib/action_dispatch/middleware/host_authorization.rb:76:in `call'

rack-mini-profiler (2.2.0) lib/mini_profiler/profiler.rb:246:in `call'

message_bus (3.3.4) lib/message_bus/rack/middleware.rb:61:in `call'

lib/middleware/request_tracker.rb:176:in `call'

railties (6.0.3.3) lib/rails/engine.rb:527:in `call'

railties (6.0.3.3) lib/rails/railtie.rb:190:in `public_send'

railties (6.0.3.3) lib/rails/railtie.rb:190:in `method_missing'

rack (2.2.3) lib/rack/urlmap.rb:74:in `block in call'

rack (2.2.3) lib/rack/urlmap.rb:58:in `each'

rack (2.2.3) lib/rack/urlmap.rb:58:in `call'

unicorn (5.7.0) lib/unicorn/http_server.rb:632:in `process_client'

unicorn (5.7.0) lib/unicorn/http_server.rb:728:in `worker_loop'

unicorn (5.7.0) lib/unicorn/http_server.rb:548:in `spawn_missing_workers'

unicorn (5.7.0) lib/unicorn/http_server.rb:144:in `start'

unicorn (5.7.0) bin/unicorn:128:in `<top (required)>'

vendor/bundle/ruby/2.6.0/bin/unicorn:23:in `load'

vendor/bundle/ruby/2.6.0/bin/unicorn:23:in `<main>'
2

I am unable to repro this on latest Discourse version.

Can you try updating your Discourse instance to latest version and testing this in safe mode? If the issue persists can you check if you have modified any relevant settings?

4 Likes
3

Thanks @techAPJ for the response. I believe that it has to do with new users postings links to the same domain exceeds the ‘newuser spam host threshold’ that are not on the ‘allowed spam host domains’.

It doesn’t seem specific to certain hosts, it seems to be just if the same host has been posted too many times by a TL0 user. It doesn’t seem specific to certain domains (like IG and Youtube).

I updated to the latest Discourse (tests passed 2.6.0beta6) with no plugins (except docker manager) or templates and confirmed the below on my test instance (with a TL0 regular user):

  • If I increase newuser spam host threshold by 1, the user can post a link (to the same domain giving a 500 error) one more time. Then they get a 500 error on the next post. This is repeatable.

  • If I add the domain to allowed spam host domains they can freely keep posting the domain url error free.

  • If I increase the user’s trust level to 1, then they can continue posting the domain url error free.

Let me know if you can’t repro with the above information and I’ll work on testing with safe mode.

2 Likes
5

Looking closely into this… it doesn’t seem to be a bug and is working as designed.

A new user is not allowed to post too many links of same hosts and if an admin wants to override this behavior they can do so by tuning newuser_spam_host_threshold and allowed_spam_host_domains site settings.

This is also reflected in the staff message we send when the post is blocked due to repeated links:

https://github.com/discourse/discourse/blob/cd93d1b5f76aa8b696783f2c5a7edf2920ef8254/config/locales/server.en.yml#L3351-L3359

2 Likes
6

This topic was automatically closed after 23 hours. New replies are no longer allowed.