Permanent deletion bug

[VincentAlse (Vincent)]

I think there is a bug with permanent deletion.

Introducing permanently delete post functionality

When a post is deleted in Discourse, we perform a soft-delete. This means that post is still present in the database in case an administrator wants to recover it later. A soft-delete is not sufficient when the deleted post contains sensitive information and must be pruned from the database completely. For those situations, we are introducing the ability to permanently delete a post. [image] This feature was implemented under a hidden site setting because of how dangerous it can be, once a pos…

I delete a couple of posts. Now I cannot open the deleted post list.

You can see here I still have 342 deleted posts. But when I click on it. It leads to a 404 page.

I can still open other user’s deletion list but not my own.

Is there anything we can do to fix it?

[VincentAlse (Vincent)]

Okay, I think I figured out the steps to recreate the bug.

I’m not sure you need two accounts but here is my situation:

1. Account A creates a topic, then pin and close the topic.
2. Account A soft deletes the topic.
3. Wait for 5 min, log into Account B, and open Account A’s deletion list (for example: www.example.com/u/username/deleted-posts)
4. Find the post Account A just soft deleted, open it.
5. If you try to permanently delete the post, it’ll show an error message: post can’t be deleted because there are other posts.
6. You need to delete the pin and close topic message below the post, then try permanently delete again.
7. You will succeed, but now you can’t open Account A’s delation list anymore.

[VincentAlse (Vincent)]

Could someone take a look at this, please?

I was cleaning some posts that contain sensitive information and now we are stuck…

[JammyDodger]

@VincentAlse

I was cleaning some posts that contain sensitive information and now we are stuck…

Can you still access the deleted posts from the topic/pm and permanently delete them from there, or can you no longer see your deleted posts at all?

[VincentAlse (Vincent)]

I can access them from the post.

But since I don’t know which posts they are, the delete post list is critical.

Without it, I must manually go through all private messages and public topics to find them.

[VincentAlse (Vincent)]

I tried deleted-posts.json too. But the information doesn’t contain deleted posts.

It only shows things like “user_badges” and other user information.

[VincentAlse (Vincent)]

If I can get a deleted post id list somehow that’ll help too.

[JammyDodger]

I’m trying for a repro:

• Admin A creates new topic, pins it globally (forever), and then closes it
• Admin A then soft-deletes topic
  
  
• Admin B finds this topic by accessing Admin A’s /deleted-posts list from their profile
• Admin B attempts to permanently delete topic - receives a “You can not permanently delete this topic because there are other posts.” error
• Admin B deletes ‘pin’ and ‘close’ small action posts
• Admin B retries permanent delete - delete is succesful
  
  
• However, Admin B now cannot access Admin A’s /deleted-posts, with an error of GET https://greedy.jammydodger.monster/posts/jammydodger/deleted?offset=0

Though Admin A and Admin C can still access Admin A’s /deleted-posts list. In the short term, @VincentAlse, could you use the secondary admin account to access the /deleted-posts list to find the other posts you wish to delete? Alternatively you could use a data-explorer query to identify them?

[VincentAlse (Vincent)]

Hi @JammyDodger

Thanks for the confirmation. I just tried Admin C (with both old account and newly created account). It doesn’t work for me. I think the reason is that I was deleting posts for many different accounts and bugged the delete listed for most of them.

Let me take a look at data-explorer. Can I query deleted posts with it?

[JammyDodger]

Ah, that is unfortunate. If you have access to the data explorer plugin I think something like this should replicate the /deleted/posts list for a particular user (with post_id thrown in for good measure):

-- [params]
-- user_id :user_id

SELECT p.created_at AS reltime$time,
       id AS post_id,
       id
FROM posts p
WHERE p.user_id = :user_id
AND p.deleted_at IS NOT NULL
ORDER BY p.created_at DESC

[VincentAlse (Vincent)]

Let me give it a try.

[JammyDodger]

Did that work out for you @VincentAlse? I think there should be multiple ways to find the posts you want to delete if that one didn’t give you the list you needed?

[VincentAlse (Vincent)]

A dumb question. What is user_id? I think my user_id is 1 based on the .json page.

I get this message: ActiveRecord::PreparedStatementInvalid: missing value for :user_id in /*

@JammyDodger

[JammyDodger]

Looking at that screenshot, it seems you’ve tweaked the parameter at the top, which will actually stop it from working. If you leave it as :user_id it will give you a selection box when you run it where you can type a user name.

Alternatively you could ditch the parameter and add the user id you got from the json to the WHERE p.user_id = line.

Does that make sense?

[darkpixlz]

Seems like you may already be getting help, but clicking on it brings me to /u/deleted-posts, which works.

[VincentAlse (Vincent)]

It works now!

I thought I needed to put user_id in the code.

Thanks a lot @JammyDodger

[nbianca (Bianca)]

I fixed the bug you reported with this PR yesterday, which has been already merged and can be deployed if you update your Discourse instance:

FIX: Posts can belong to hard-deleted topics

However, we figured out that hard deleting topics could leave orphan small actions posts in the database. This second bug was fixed with:

FIX: Destroy all posts when hard deleting topic

I think everything should be working fine now. Please let us know if you have more problems.