History from previous project is shown

[Glandos]

• Create a project
• Add some participants
• Show participants creation in history
• Delete the project
• Create it again
• See that old entries are shown in history

This lead to data leak. History must be cleared upon project deletion.

[deepthivalisetti]

Hi. I am trying to solve this issue. Can you let me know if the project is deleted, should the user data also be erased?
As I see, the person is having project id linked and on that basis if the project name is the same as the old one, its fetching the data. I have come up with 2 options.

• remove the Person data linked to the project
• remove the Project linked to the Person

[almet]

Hi. I am trying to solve this issue. Can you let me know if the project is deleted, should the user data also be erased? As I see, the person is having project id linked and on that basis if the project name is the same as the old one, its fetching the data. I have come up with 2 options.

* remove the Person data linked to the project

* remove the Project linked to the Person

I don't think you've understood the issue we're facing, so let me explain it differently : the history is stored in a separate database table than the projects. When the project is deleted, history should be deleted too, but it's not the case at the moment.

To solve this issue, you need to also delete the extra information.

[Glandos]

Yes, history is handled by SQLAlchemy-continuum, and there are some functions to manage this, but I still have to read its documentation :)

[Glandos]

First investigations results:

• This should be done manually: How can I clear the change history on a per-row basis? kvesteri/sqlalchemy-continuum#124 (comment)
• Deleting project history on project delete seems a bit hard: what if we need an undelete on it?
• Maybe we can delete project history on project creation? Only when the old one is old enough? How much days? One week seems enough to me.

[almet]

Deleting project history on project delete seems a bit hard: what if we need an undelete on it?

Interesting :-) At the moment we don't have any way to do this, unless I missed it. I believe it's alright. If we want to be sure that it's meant to be deleted, then we could maybe let only the person with an access to the specified email receive a confirmation email to delete the project.