Subject: [Wocky] Flaw in reciprocal buddy-adding

From: Greg Hudson <[email-masked]>
Date: Tue, 20 Dec 2005 14:31:17 -0500

Until today, I never actually added anyone to my Gaim buddies
proactively (except for myself).  I always waited until they added me,
at which point after I authorized them I was asked if I wanted to
reciprocally add them, and I said yes.

Gaim does not seem to request authorization when you reciprocally add
a buddy.  I just tried this with systest (using @mit.edu on all the
JIDs, of course):

  systest adds ghudson as a buddy
  ghudson receives an authorization dialog
  ghudson reciprocally adds systest as a buddy
  systest does *not* receive an authorization dialog
  systest appears offline to gaim, or "Not authorized" if I l-click

If I r-click and "(Re-)request authorization" from systest, systest
gets an authorization dialog and all becomes kosher.

I assume this is a Gaim bug, but it could conceivably be a jabberd bug
if the server is expected to provide reciprocal access.  I will put
this on my list of things to dig into.

---

From: Greg Hudson <[email-masked]>
Date: Wed, 28 Dec 2005 16:19:07 -0500

> I assume this is a Gaim bug, but it could conceivably be a jabberd
> bug if the server is expected to provide reciprocal access.  I will
> put this on my list of things to dig into.

It's a Gaim bug.  Here's what happens:

  1. Alice adds a buddy Bob
  2. Bob receives an authorization request for Alice's subscription
  3. Bob approves the request (message sent to server)
  4. Bob's Gaim process sees that Alice is not currently a buddy, and
     displays the reciprocal buddy-adding dialog.  (Like all Gaim
     dialogs, this one is non-modal, so control returns to the main
     loop.)
  5. Bob's Gaim receives a roster push from the server containing a
     buddy entry for Alice, with a subscription type of 'From'.  Bob's
     Gaim stuffs that into the 'Buddies' group since no group is
     specified.
  6. Bob finishes filling out the reciprocal buddy-adding form, thus
     asking Gaim to add Alice to his 'Buddies' group.  (If Bob chooses
     a different group, then things actually work.)
  7. Bob's Gaim sees that Alice is already a buddy, due to the roster
     push in step 5, and does nothing.  Bob may as well have clicked
     cancel on the reciprocal buddy-adding dialog.

There is clearly an impedance mismatch between Jabber, where you can
have a buddy entry but not have requested subscription rights, and
Gaim, which was built around the simpler AIM model.  Also, it's not
clear to me that Gaim is making a wise decision by sticking ungrouped
roster entries in the 'Buddies' group.

Confusing matters, the conditional in step 7 only appears on the gaim
1.5 branch, along with a bunch of other work which never seems to have
made it to the mainline.  So Gaim 2.0 probably doesn't manifest this
bug, but might manifest other bugs instead.

I will test some candidate fixes soon, and will also try this scenario
and some related scenarios in the Gaim 2.0 beta.

---

From: Greg Hudson <[email-masked]>
Date: Fri, 30 Dec 2005 13:41:13 -0500

> Confusing matters, the conditional in step 7 only appears on the
> gaim 1.5 branch, along with a bunch of other work which never seems
> to have made it to the mainline.  So Gaim 2.0 probably doesn't
> manifest this bug, but might manifest other bugs instead.

> I will test some candidate fixes soon, and will also try this
> scenario and some related scenarios in the Gaim 2.0 beta.

As I expected, Gaim 2.0 beta exhibits differently-buggy behavior.
With the older code (which is in the newer release), the reciprocal
buddy add works, but the local buddy list winds up with two entries
for the same buddy, one of which is functional and one of which is
not.  The redundant entry does not exist on the server, so if you quit
and restart Gaim, the redundant entry is cleaned up and you wind up
with just one, functional buddy entry.

I came up with a fix for the Gaim 1.5 behavior which does the right
thing: if you're trying to add a buddy which already exists, tell the
server to add it, but don't redundantly add it to the local buddy
list.  I've checked this into the Gaim repository in
/afs/dev.mit.edu/project/jabber, in anticipation of a local deployment
with some Jabber fixes and GSSAPI support.

There was an old bug entry for the old bug, so I submitted my findings
there.  See:

https://sourceforge.net/tracker/?func=detail&atid=100235&aid=1041829&group_id=235