Repository: fedora-infra/bodhi

Issue:
Bodhi sends notifications to old address after e-mail change
I've changed my e-mail addresses in all locations I could think of:
- [fedmsg](https://apps.fedoraproject.org/notifications)
- [bugzilla](https://bugzilla.redhat.com/)
- [Fedora Admin](https://admin.fedoraproject.org/accounts/)

But I still get notifications from bodhi at my old address about updates I've commented on, see the message below for an example.

It looks like this message doesn't come from fedmsg, the mail doesn't have any X-Fedmsg header fields. If I click on "Manage Alerts" in bodhi, it shows my fedmsg settings (the new e-mail address).

I initially thought this is a caching issue. But I changed my address months ago and I still get notifications to my old address. In addition to that, I also get fedmsg style notifications to my new address, but only about my own comments.

I'm not sure if this is a bug or I forgot to change my address somewhere. If it's the latter, I would expect "Manage alerts" to point to the right location.

Example message:

> Return-Path: updates@fedoraproject.org
> Delivered-To: hofmann@kbsg.rwth-aachen.de
> Received: from mx-out-2.rwth-aachen.de (mx-out-2.rwth-aachen.de [134.130.5.187])
>   (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
>   (Client CN "mx-out-2.rwth-aachen.de", Issuer "RWTH Aachen CA" (verified OK))
>   by lagrande.kbsg.rwth-aachen.de (Postfix) with ESMTPS id 7FA403FAD7
>   for hofmann@kbsg.rwth-aachen.de; Fri,  2 Sep 2016 01:00:39 +0200 (CEST)
> X-IronPort-Anti-Spam-Filtered: true
> X-IronPort-Anti-Spam-Result: A0BnAQAJsshXhwK1hNFdHAEBBAEBgywBAQEBAXV8pHaRLIQRJIV4AoIkAQIBAQEBAQITAQEBCgsJCRkvhGICAQOBCSwPFg9IiGEOuwcBAQEBAQEEAQEBAQEBASCGLIIDhnABAQVkgXwLWIIvBZlQhiCJB4F3ToQPgw2GAIZwhViDeYMdEQqBTTw0hE2CHwEBAQ
> X-IPAS-Result: A0BnAQAJsshXhwK1hNFdHAEBBAEBgywBAQEBAXV8pHaRLIQRJIV4AoIkAQIBAQEBAQITAQEBCgsJCRkvhGICAQOBCSwPFg9IiGEOuwcBAQEBAQEEAQEBAQEBASCGLIIDhnABAQVkgXwLWIIvBZlQhiCJB4F3ToQPgw2GAIZwhViDeYMdEQqBTTw0hE2CHwEBAQ
> X-IronPort-AV: E=Sophos;i="5.30,268,1470693600"; 
>    d="scan'208";a="456213363"
> Received: from bastion01.fedoraproject.org (HELO bastion.fedoraproject.org) ([209.132.181.2])
>   by mx-2.rz.rwth-aachen.de with ESMTP; 02 Sep 2016 01:00:39 +0200
> Received: from bodhi03.phx2.fedoraproject.org (bodhi03.phx2.fedoraproject.org [10.5.126.115])
>   by bastion01.phx2.fedoraproject.org (Postfix) with ESMTP id C7A8A6070D39
>   for hofmann@kbsg.rwth-aachen.de; Thu,  1 Sep 2016 23:00:36 +0000 (UTC)
> From: updates@fedoraproject.org
> To: hofmann@kbsg.rwth-aachen.de
> X-Bodhi-Update-Builds: kernel-4.7.2-201.fc24
> In-Reply-To: bodhi-update-66003-labbott-F24@admin.fedoraproject.org
> X-Bodhi-Update-Pushed: True
> X-Bodhi-Update-Type: security
> X-Bodhi-Update-Release: F24
> References: bodhi-update-66003-labbott-F24@admin.fedoraproject.org
> X-Bodhi-Update-Status: testing
> X-Bodhi-Update-Request: stable
> X-Bodhi-Update-Submitter: labbott
> X-Bodhi-Update-Title: kernel-4.7.2-201.fc24
> X-Bodhi: fedoraproject.org
> Subject: [Fedora Update] [CRITPATH] [comment] kernel-4.7.2-201.fc24
> Message-Id: 20160901230036.C7A8A6070D39@bastion01.phx2.fedoraproject.org
> Date: Thu,  1 Sep 2016 23:00:36 +0000 (UTC)
> [message body skipped]



Discussion:
In case it's relevant: I changed my address around June 22, 2016.

I have also been experiencing this issue, and I believe that fixing it would have helped with #1005.

I think the fix is probably easy - when users log in, Bodhi should check to see if their FAS e-mail address matches the User.email field. If not, it should update and commit the transaction. I believe this is probably an easy fix, though I haven't looked at the code.

Hey, I would like to work on this issue. Can you assist me?
Thanks.

I believe the problem is that this block of code is not working as intended, but I am not sure why (I've not looked into it myself):

https://github.com/fedora-infra/bodhi/blob/2.2.4/bodhi/server/security.py#L94-L98


Resolving patch:
diff --git a/bodhi/server/security.py b/bodhi/server/security.py
--- a/bodhi/server/security.py
+++ b/bodhi/server/security.py
@@ -91,9 +91,8 @@ def remember_me(context, request, info, *args, **kw):
         db.add(user)
         db.flush()
     else:
-        # We used to not track email addresses, so fill in the fields as people
-        # log back in
-        if not user.email:
+        # Update email address if the address changed
+        if user.email != email:
             user.email = email
             db.flush()
 


Test patch: