fix(updater): Prevent EventSource auto-reconnect from triggering concurrent upgrades#59143
Draft
joshtrichards wants to merge 3 commits intomasterfrom
Draft
fix(updater): Prevent EventSource auto-reconnect from triggering concurrent upgrades#59143joshtrichards wants to merge 3 commits intomasterfrom
joshtrichards wants to merge 3 commits intomasterfrom
Conversation
The browser's native EventSource API silently reconnects on connection loss. Since core/ajax/update.php is non-idempotent (it runs database migrations, enables/disables apps, toggles maintenance mode), a reconnect causes a second concurrent upgrade process to race against the first. This can result in duplicate migrations, deadlocks, or silent data corruption -- none of which would be traceable back to the SSE transport layer. Explicitly close the EventSource on error and inform the user that the connection was lost, advising them to reload to check status. Signed-off-by: Josh <josh.t.richards@gmail.com>
7 tasks
Signed-off-by: Josh <josh.t.richards@gmail.com>
Member
Author
|
/compile |
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The native
EventSourceAPI automatically reconnects when a connection drops. For the web updater, this is dangerous:core/ajax/update.phpis not idempotent -- it runs database migrations, toggles maintenance mode, and modifies app state. A silent reconnect spawns a second PHP process that races against the still-running first one, which can cause migration deadlocks, database corruption, or inconsistent app state.The auto-reconnect is dangerous specifically because it re-enters
core/ajax/update.phpdirectly, which has no guard against concurrent execution -- it just checksUtil::needUpgrade()andcalls $updater->upgrade(). A manual reload goes through normal routing (e.g.OC::handleRequest()) which respects maintenance mode.This is especially insidious because the reconnect is invisible to the user. Resulting failures (stuck maintenance mode, broken apps, corrupted schema) would never be traced back to the SSE transport layer.
Changes:
onerrorhandler to the underlyingEventSourcethat immediately closes the connection instead of allowing auto-reconnect.TODO
Checklist
3. to review, feature component)stable32)AI (if applicable)