-
Notifications
You must be signed in to change notification settings - Fork 3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[C+ Checklist needs completion] [$1000] Web - App allows user to open request money link of other user and displays amount page twice #23755
Comments
Triggered auto assignment to @greg-schroeder ( |
Bug0 Triage Checklist (Main S/O)
|
ProposalPlease re-state the problem that we are trying to solve in this issue.App allows user to open request money link of other user and displays amount page twice What is the root cause of that problem?This happens because the props.iou.id is not equal to moneyRequestID (constructed from) reportID of the component, which comes from the url, since the url that initiated the component was from a different account, component resets while editing by checking the value in the variable shouldReset here:
Having it reset while editing dirupts the UX of the app. A refresh should ideally not be triggered while editing What changes do you think we should make in order to solve the problem?We should show Edit: Since the pages went through a refactor
What alternative solutions did you explore? (Optional)We can check if the reportID in the url is one that the user has access to, by using |
I definitely don't think this makes sense. I'm pretty sure this link just shouldn't be accessible, right? |
Job added to Upwork: https://www.upwork.com/jobs/~017939880358ebbb25 |
Current assignee @greg-schroeder is eligible for the External assigner, not assigning anyone new. |
Triggered auto assignment to Contributor-plus team member for initial proposal review - @sobitneupane ( |
ProposalPlease re-state the problem that we are trying to solve in this issue.Web - App allows user to open request money link of other user and displays amount page twice What is the root cause of that problem?We don't have a check to display not found page when we access to all request money page in a report. When we access to request money amount page with invalid ReportID, page will goBack to amount page because the amount is empty
In amount page because report doesn't found, we go to participant page without reportID after clicking the next button.
And then in participant page, App/src/pages/iou/steps/MoneyRequstParticipantsPage/MoneyRequestParticipantsPage.js Line 72 in b2381f6
What changes do you think we should make in order to solve the problem?All pages in the step of requesting money should display not found page if the report with the reportID param doesn't exit in Onyx. We can duplicate all pages in the step of requesting money. One page for the route that doesn't contain We used this way to display share code page for the current user and reports. It's a bit complicated so I put it on a branch to keep an eye on if needed https://github.com/dukenv0307/App/tree/fix/23755 What alternative solutions did you explore? (Optional)We can refactor
As @bernhardoj mentioned, we only need to add this HOC to amount page and in this page we only need wrap not found page if the report cannot create request money. Actually, task flow is the same with money request flow so we can also use this HOC for task flow. And in each task page we only need to display not found page if the report cannot create task. |
ProposalPlease re-state the problem that we are trying to solve in this issue.The issue here is not that we can open other user's money request URL. Everyone can access /request/new/{reportID}. The only difference is, does the user has access to the reportID? When the user does not have access to it, pressing Next will bring the user back to the amount page again. What is the root cause of that problem?When the user press Next, it should be navigated to the participant page. But on the participant page, we will navigate the user back if the amount is empty or the iou ID is not the same as the current ID. The iou ID is constructed from the iou type + report id, for example, App/src/pages/iou/steps/MoneyRequstParticipantsPage/MoneyRequestParticipantsPage.js Lines 72 to 79 in b2381f6
If the current ID (that is taken from the route params) is different from what we have in Onyx, we want the user to start over the money request flow. This is to prevent the user doing a request with invalid data, for example doing a request money with split bill data (specifically the participants). In our case, the current money request id is different from what we have in Onyx. When we open the money request with an invalid report id and press Next, it will
When we arrive on the participants page, because the report id is now missing from the params, the current money request id (request) is different from what we have in Onyx (request{invalidReportId}), which "kicks" us back to the amount page. What changes do you think we should make in order to solve the problem?We can allow the user to keep continue the money request/split bill with an invalid report id. If the report id is invalid, we will just treat it as a new money request that is initiated by the FAB. Here is what we need to do:
What alternative solutions did you explore? (Optional)If we don't want to allow the user to start a request with an invalid report ID, then we can show the not found page if the
Notice the above condition, we want to check this condition
only if we have In case the report collection is not ready yet because of the app loading, we should show a loading indicator.
Same as above, we want to check (add the above codes in We only need to do this on the amount page because there is no way the user can go further steps without going through the amount page. (don't forget to set default props of |
Awaiting proposal review from @sobitneupane |
Same as above |
The issue is quite complicated. Going to review it shortly. |
Thanks for the proposal @neonbhai. Can you please extend your proposal to include other pages in request money and split bill flow. |
Thanks for the proposal @dukenv0307. I think there are easier ways to deal with the issue. Can't we go with some simpler solution like the one proposed by @neonbhai here? |
Thanks for the proposal @bernhardoj. But I think expected behavior is to not allow user to access such reports as suggested here. |
@sobitneupane okay! will extend proposal to other pages shortly |
@sobitneupane When we open a deeplink of confirm page with an exist reportID we should reset it to the amount page to enter an amount before going to confirm page. |
This expected behavior is included in my alternative solution |
📣 It's been a week! Do we have any satisfactory proposals yet? Do we need to adjust the bounty for this issue? 💸 |
|
The solution for this issue has been 🚀 deployed to production 🚀 in version 1.3.88-11 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:
If no regressions arise, payment will be issued on 2023-10-30. 🎊 After the hold period is over and BZ checklist items are completed, please complete any of the applicable payments for this issue, and check them off once done.
For reference, here are some details about the assignees on this issue:
As a reminder, here are the bonuses/penalties that should be applied for any External issue:
|
BugZero Checklist: The PR fixing this issue has been merged! The following checklist (instructions) will need to be completed before the issue can be closed:
|
It seems there was a regression here: #30148 |
Oh am I supposed to do the checklist now? I thought it was still C+s (i.e. @sobitneupane ) |
@sobitneupane and @dukenv0307 do you think you can get that checklist done shortly? Then we can get this paid and closed out. Thanks! |
sorry was OOO yesterday, processing today |
Offers sent to @dhanashree-sawant and @dukenv0307 |
Just waiting on checklist |
Bumping on the checklist @dukenv0307 and @sobitneupane - do you think you can finish that out this week? Thanks! I can help with the first parts if needed. |
BugZero Checklist:
|
Regression Test Proposal:
Do we agree 👍 or 👎 |
@dangrous, @sobitneupane, @greg-schroeder, @dukenv0307 Uh oh! This issue is overdue by 2 days. Don't forget to update your issues! |
Tests look good to me! |
Thanks! Filing regression test |
paid, regression test filed |
@greg-schroeder Can we get payment summary so I can request payment. |
Bump on this @greg-schroeder |
Oh, sorry @sobitneupane |
Went back through the offers from a couple months ago ... $1k issue but there was a regression. Final payments were: C: $500 So you can make a manual request for this one! |
Thanks @greg-schroeder Requested payment on newDot. |
$500 payment approved for @sobitneupane based on comment above. |
If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!
Action Performed:
Expected Result:
App should not allow you to open request money confirmation page for other users
Actual Result:
App allows you to open request money confirmation page for other users
Workaround:
Unknown
Platforms:
Which of our officially supported platforms is this issue occurring on?
Version Number: 1.3.46-0
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation
request.money.page.twice.mov
Recording.3944.mp4
Expensify/Expensify Issue URL:
Issue reported by: @dhanashree-sawant
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1690396372826599
View all open jobs on GitHub
Upwork Automation - Do Not Edit
Issue Owner
Current Issue Owner: @greg-schroederThe text was updated successfully, but these errors were encountered: