github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-21 10:41:50 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[GH-ISSUE #2315] Webhook payload contains stale task data due to reloadEventData reading uncommitted transaction #6633

New Issue
Closed
opened 2026-04-20 17:13:40 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-20 17:13:40 -05:00
Owner
Copy Link

Originally created by @maggch97 on GitHub (Feb 28, 2026).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2315

Pre-submission checklist

  • I have searched for existing open or closed issue reports with the same problem.

Description

I use the webhook to track each task's done status, after upgrading to 2.0.0, I noticed that the done status in webhook payload maybe wrong.

Below is anylsis from copilot

  reloadEventData() (introduced in #2135) re-reads entities from the database before sending
  webhook payloads. However, events.Dispatch() is called inside updateSingleTask() before the
  enclosing transaction is committed in the web handler (pkg/web/handler/update.go:86).

  Since WebhookListener.Handle() opens a new database session (db.NewSession()), it cannot see
  the uncommitted changes from the original transaction. This causes reloadTaskInEvent() to
  overwrite the correct event payload with stale data from the database.

  Steps to reproduce:

   1. Register a webhook for task.updated events
   2. Toggle a task's done status
   3. Observe that the webhook payload sometimes contains the old done value

  Root cause:

   updateSingleTask() — inside transaction s:
     1. s.Update(&ot)          // write done=true, NOT committed
     2. events.Dispatch(...)   // publish event (payload has done=true)
        └─ WebhookListener goroutine:
           3. s2 := db.NewSession()
           4. reloadTaskInEvent(s2) → ReadOne()  // reads done=false (old value)
     
   web handler:
     5. s.Commit()             // done=true finally visible
     ```

### Vikunja Version

latest

### Browser and version

_No response_

### Can you reproduce the bug on the Vikunja demo site?

Please select

### Screenshots

_No response_
Originally created by @maggch97 on GitHub (Feb 28, 2026). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2315 ### Pre-submission checklist - [x] I have searched for existing open or closed issue reports with the same problem. ### Description I use the webhook to track each task's done status, after upgrading to 2.0.0, I noticed that the done status in webhook payload maybe wrong. Below is anylsis from copilot ``` reloadEventData() (introduced in #2135) re-reads entities from the database before sending webhook payloads. However, events.Dispatch() is called inside updateSingleTask() before the enclosing transaction is committed in the web handler (pkg/web/handler/update.go:86). Since WebhookListener.Handle() opens a new database session (db.NewSession()), it cannot see the uncommitted changes from the original transaction. This causes reloadTaskInEvent() to overwrite the correct event payload with stale data from the database. Steps to reproduce: 1. Register a webhook for task.updated events 2. Toggle a task's done status 3. Observe that the webhook payload sometimes contains the old done value Root cause: updateSingleTask() — inside transaction s: 1. s.Update(&ot) // write done=true, NOT committed 2. events.Dispatch(...) // publish event (payload has done=true) └─ WebhookListener goroutine: 3. s2 := db.NewSession() 4. reloadTaskInEvent(s2) → ReadOne() // reads done=false (old value) web handler: 5. s.Commit() // done=true finally visible ``` ### Vikunja Version latest ### Browser and version _No response_ ### Can you reproduce the bug on the Vikunja demo site? Please select ### Screenshots _No response_
GiteaMirror commented 2026-04-20 17:13:41 -05:00
Author
Owner
Copy Link

@maggch97 commented on GitHub (Feb 28, 2026):

Image
<!-- gh-comment-id:3976224076 --> @maggch97 commented on GitHub (Feb 28, 2026): <img width="1023" height="596" alt="Image" src="https://github.com/user-attachments/assets/955820fb-0de5-4b62-a125-92a76590f85c" />
GiteaMirror commented 2026-04-20 17:13:41 -05:00
Author
Owner
Copy Link

@maggch97 commented on GitHub (Feb 28, 2026):

I checked again, reloadTaskInEvent existed before #2135, so this is not a new issue imported by the PR. The fix would be to dispatch the event after db session commit.

<!-- gh-comment-id:3976246726 --> @maggch97 commented on GitHub (Feb 28, 2026): I checked again, `reloadTaskInEvent` existed before #2135, so this is not a new issue imported by the PR. The fix would be to dispatch the event after db session commit.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6633
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?