instance name can shadow object attributes

Bug #432766 reported by Rob Speer
18
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Launchpad itself
Triaged
Low
Unassigned
lazr.restful
Triaged
Low
Unassigned

Bug Description

I am trying to add a milestone to the https://launchpad.net/divisiui/releases branch. After I fill in the form, no matter whether I am using edge or not, clicking the submit button causes it to fail with the message "Method not allowed".

Curtis Hovey (sinzui)
Changed in launchpad-registry:
assignee: nobody → Edwin Grubbs (edwin-grubbs)
Revision history for this message
Curtis Hovey (sinzui) wrote :

Edwin. Please investigate this. I see

    400 Error retrieving series data. No such operation: get_timeline

when accessing the timeline on the series page. I can see the timeline on the project page. I can access the release too. Since creating a milestone and the showing the timeline both require AJAX. I think that one problem is manifesting itself in two ways. I I ponder at missing page_tiltle could cause a 500 error, but not a 400.

Revision history for this message
Edwin Grubbs (edwin-grubbs) wrote : Re: [Bug 432766] Re: Cannot add a milestone

This is the url generating the "No such operation: get_timeline" error:
  https://edge.launchpad.net/api/beta/divisiui/releases?ws.op=get_timeline&include_inactive=true

Interestingly, the other series does not have this error. Neither does
the project itself, which is surprising, because the
project.get_timeline() actually calls each series.get_timeline().
  https://edge.launchpad.net/api/beta/divisiui/prototype?ws.op=get_timeline&include_inactive=true
  https://edge.launchpad.net/api/beta/divisiui?ws.op=get_timeline&include_inactive=true

I traced down the error message to this method in
lazr/restful/_resource.py. I have no idea why one series would get a
ComponentLookupError and not the other one. Because it catches the
exception, there is no useful information in the logs.

    def handleCustomGET(self, operation_name):
        """Execute a custom search-type operation triggered through GET.

        This is used by both EntryResource and CollectionResource.

        :param operation_name: The name of the operation to invoke.
        :return: The result of the operation: either a string or an
        object that needs to be serialized to JSON.
        """
        try:
            operation = getMultiAdapter((self.context, self.request),
                                        IResourceGETOperation,
                                        name=operation_name)
        except ComponentLookupError:
            self.request.response.setStatus(400)
            return "No such operation: " + operation_name
        return operation()

Revision history for this message
Edwin Grubbs (edwin-grubbs) wrote :

On a whim, I tried recreating the error by changing the name of
another series to "releases", and boom. The reason this causes the
error is that IProduct.releases is an exported attribute name, and
https://edge.launchpad.net/api/beta/divisiui/releases references that
attribute. If you try the "series", you will get the same error.
"name" and "title" won't give you a "No such operation" error, since
it ignores the ws.op=get_timeline parameter, since REST method calls
can only occur on objects that can have methods exported.

Changing the name of the series from "releases" will fix both the
timeline graph and the "Method not allowed" error when creating a
milestone.

I will assign this bug to Leonard, since it is a lazr.restful issue.

affects: launchpad-registry → launchpad-foundations
Changed in launchpad-foundations:
assignee: Edwin Grubbs (edwin-grubbs) → Leonard Richardson (leonardr)
Curtis Hovey (sinzui)
Changed in launchpad-foundations:
status: New → Triaged
importance: Undecided → Low
affects: launchpad → lazr.restful
Changed in lazr.restful:
importance: Undecided → Low
status: New → Triaged
summary: - Cannot add a milestone
+ instance name can shadow object attributes
William Grant (wgrant)
Changed in launchpad:
assignee: Leonard Richardson (leonardr) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.