Skip to content

[HOLD - should be resolved by #23755][$500] [Distance] - User is able to request money from an archived workspace using link #27113

Closed

Description

@kbecciv

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!


Action Performed:

  1. Request money -> distance
  2. Fill start and finish points
  3. Select a workspace
  4. Copy link
  5. Delete that workspace
  6. Past the copied link

Expected Result:

Users should not have the ability to request money from an archived workspace

Actual Result:

The User is able to request money from an archived workspace

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

  • Android / native
  • Android / Chrome
  • iOS / native
  • iOS / Safari
  • MacOS / Chrome / Safari
  • MacOS / Desktop

Version Number: 1.3.66.3
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

distance-archive.webm
Recording.4370.mp4

Expensify/Expensify Issue URL:
Issue reported by: @hichamcc
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1693924665226099

View all open jobs on GitHub

Upwork Automation - Do Not Edit
  • Upwork Job URL: https://www.upwork.com/jobs/~0144d881c5d2a1b34f
  • Upwork Job ID: 1700942638080782336
  • Last Price Increase: 2023-09-10

Activity

  1. added
    ExternalAdded to denote the issue can be worked on by a contributor
    BugSomething is broken. Auto assigns a BugZero manager.
    on Sep 10, 2023
  2. DylanDylann commented on Sep 10, 2023

    @DylanDylann
    Contributor

    Proposal

    Please re-state the problem that we are trying to solve in this issue.

    [Distance] user is able to request money from an archived workspace using link

    What is the root cause of that problem?

    const shouldDisableButton = selectedParticipants.length === 0;

    This is the condition to disable the Request button. We don't check if the policy is archive or not

    What changes do you think we should make in order to solve the problem?

    In MoneyRequestConfirmationList, we should add a condition to check if workspace is deleted. If that we should disable button and display a error message like this

    Screenshot 2023-09-08 at 14 52 33

    To do that, in herehttps://github.com/Expensify/App/blob/911fe99c56116f1a36c38fb596251bbce5fc1b33/src/components/MoneyRequestConfirmationList.js#L361
    we should update the condition like that

    const shouldDisableButton = selectedParticipants.length === 0 || (props.isDistanceRequest && ReportUtils.isArchivedRoom(selectedParticipants[0]));
    

    and in here,

    isDisabled: ReportUtils.isOptimisticPersonalDetail(participant.accountID),

    add an error message

    brickRoadIndicator: (props.isDistanceRequest && ReportUtils.isArchivedRoom(selectedParticipants[0])) ? CONST.BRICK_ROAD_INDICATOR_STATUS.ERROR : null,
    allReportErrors:  (props.isDistanceRequest && ReportUtils.isArchivedRoom(selectedParticipants[0])) ? ['Please select a valid participant']  : null,   // need to use translation here
    

    The completed code change will be implemented in the PR phrase

    What alternative solutions did you explore? (Optional)

    If the selected workspace is deleted, we will redirect to the distance request page. To do that,


    Add condition and logic to redirect to distance page

    if (isDistanceRequest && ReportUtils.isArchivedRoom(participants[0])) {
                Navigation.goBack(ROUTES.getMoneyRequestRoute(iouType.current, reportID.current), true);
            }
    
    
  3. namhihi237 commented on Sep 10, 2023

    @namhihi237
    Contributor

    Proposal

    Please re-state the problem that we are trying to solve in this issue.

    [Distance] user is able to request money from an archived workspace using a deep link

    What is the root cause of that problem?

    We have logic to check some conditions to return to the money request page. Here we have not checked whether the workspace is archived or not.

    if (_.isEmpty(props.iou.participants) || (props.iou.amount === 0 && !props.iou.receiptPath) || shouldReset) {
    Navigation.goBack(ROUTES.getMoneyRequestRoute(iouType.current, reportID.current), true);
    }

    That's why we can open the confirm request page even though the WS has been deleted

    What changes do you think we should make in order to solve the problem?

    We can add a condition to check if the room is archived or not to leave the money request page.

    if (_.isEmpty(props.iou.participants) || (props.iou.amount === 0 && !props.iou.receiptPath && !isDistanceRequest) || shouldReset || ReportUtils.isArchivedRoom(props.report)) {

    What alternative solutions did you explore? (Optional)

    In addition, if we do not want to return to the money request page, we can show not found page by grawp content with FullPageNotFoundView

  4. changed the title [-][Distance] - User is able to request money from an archived workspace using link[/-] [+][$500] [Distance] - User is able to request money from an archived workspace using link[/+] on Sep 10, 2023
  5. melvin-bot commented on Sep 10, 2023

    @melvin-bot
  6. melvin-bot commented on Sep 10, 2023

    @melvin-bot

    Triggered auto assignment to @johncschuster (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

  7. added
    Help WantedApply this label when an issue is open to proposals by contributors
    on Sep 10, 2023
  8. melvin-bot commented on Sep 10, 2023

    @melvin-bot

    Bug0 Triage Checklist (Main S/O)

    • This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
    • This bug is not a duplicate report (check E/App issues and #expensify-bugs)
      • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
    • This bug is reproducible using the reproduction steps in the OP. S/O
      • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
      • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
    • This issue is filled out as thoroughly and clearly as possible
      • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
    • I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync
  9. melvin-bot commented on Sep 10, 2023

    @melvin-bot

    Triggered auto assignment to @garrettmknight (External), see https://stackoverflow.com/c/expensify/questions/8582 for more details.

  10. melvin-bot commented on Sep 10, 2023

    @melvin-bot

    Triggered auto assignment to Contributor-plus team member for initial proposal review - @mollfpr (External)

  11. 13 remaining items

  12. garrettmknight commented on Oct 25, 2023

    @garrettmknight
    Contributor

    Still holding on #23755

  13. garrettmknight commented on Oct 25, 2023

    @garrettmknight
    Contributor

    Moving daily to retest - there was a regression on the issue we were holding on so it still might be an issue.

  14. melvin-bot commented on Oct 31, 2023

    @melvin-bot

    @garrettmknight, @mollfpr Huh... This is 4 days overdue. Who can take care of this?

  15. garrettmknight commented on Oct 31, 2023

    @garrettmknight
    Contributor

    Haven't had a chance to retest today - will do tomorrow.

  16. garrettmknight commented on Nov 1, 2023

    @garrettmknight
    Contributor

    This has been fixed, once you reload the distance request you're required to select a new workspace.

    @hichamcc accept the offer and I'll pay the reporting bonus.

    Upwork job for my reference: https://www.upwork.com/en-gb/ab/applicants/1719789138652127232/hired

  17. hichamcc commented on Nov 1, 2023

    @hichamcc

    Done

  18. garrettmknight commented on Nov 1, 2023

    @garrettmknight
    Contributor

    Paid, closing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Awaiting PaymentAuto-added when associated PR is deployed to productionBugSomething is broken. Auto assigns a BugZero manager.DailyKSv2ExternalAdded to denote the issue can be worked on by a contributorHelp WantedApply this label when an issue is open to proposals by contributors

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions