Skip to content

fix issue where management console password would reset on user account creation

Administrator requested to merge sg/mgmt-password-reset into master

Created by: slimsag

This fixes a highly annoying (but NOT a security risk) issue where the management console password would incorrectly be reset to a newly generated secure password each time a user account was created.

This issue accurately describes the problem in detail: https://github.com/sourcegraph/sourcegraph/issues/3201

The fix here is the quick and easily verifiable one: we carry over the result from the prior row, so that all rows in the table have the same mgmt console password fields.

A separate issue (and higher risk to make, which is why I am not doing it now) is to correct this code such that it does not create duplicate entries in the global_state table. This is tricky to do because there is a high risk of introducing performance regressions as every Sourcegraph action goes through this initalization check. If memory serves me correctly, duplicate entries was a known property of the implementation at the time this code was written in order to avoid locking the table and harming perf but thought to not be a concern (clearly incorrectly, as we the site_id field also changes regularly which harms our metrics in small various ways according to Dan).

I am confident this is a safe, good, incremental change to make (famous last words).

Helps #3201

After merge, that issue will become:

  • "Cleanup global_state DB code to remove duplicate entries and prevent site_id from changing"

Test plan: Tested manually and against existing tests for this code (which caught one bug in my first implementation)

Merge request reports