When a user is deleted from /admin/user/user in a way that submits/confirms the delete users form twice or more, it results in the user_delete() function to be called several times, which in return invokes the 'delete' op for other modules with $account being set to FALSE/0 => this yields other modules acting on the anonymous user account 0.

Reconstruct:

  1. Go to /admin/user/user
  2. Toggle a test user to be deleted
  3. Choose 'delete the selected users' and click 'Update'
  4. Click 'Delete All' in the confirmation form
  5. Wait a few seconds or immediately after click on 'Delete All' in the submitting form

What happens is that the form will submit and invoke the user_delete() function which will load the user:

function user_delete($edit, $uid) {
  $account = user_load(array('uid' => $uid));

This is ok for the first time that the form is submitted, but in the second time that the form is submitted while being executed, that user no longer exists because it has been deleted already by the former, original, 'Delete All' button click.
So now, in the 2nd time, the user has clicked the 'Delete All' button the user entry doesn't exist, hence user_load() returns FALSE and sets $account accordingly. Although, this does not stop from the rest of the code to execute and when other modules are invoked, such as:

function user_delete($edit, $uid) {
  // continued rest of the function code:
  user_module_invoke('delete', $edit, $account);
}

$account is actually 0 due to weak typing, resulting in module's being invoked and working accidentally on uid 0.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

lirantal’s picture

Provided patch that checks user_load()'s returned value.

Regards,
Liran Tal.

lirantal’s picture

Status: Needs work » Needs review

Updated issue status for provided patch.

mdupont’s picture

User #0 (Anonymous) should never be deleted, and I guess it's the same for user #1 (admin). Also as an admin I can see a Delete button on user/0/edit and user/1/edit... They should be hidden too.

lirantal’s picture

While I agree with you @mdupont, you are raising an issue which is not directly related to this topic.
I'm fine with tackling and providing a patch for the topic you raised in a new issue if you confirm.

lirantal’s picture

*ping

aspilicious’s picture

Status: Needs review » Reviewed & tested by the community

its ok to have an aditional test

lirantal’s picture

Alright, so are we pushing this in...?

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 1: user_module_submit_handling-1728040-1.patch, failed testing.

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.