Aug 17 - Fix bug, cross-customer form-name leak

app/routes/issues.py

@@ -1033,16 +1033,23 @@ def bulk_action():
                 flash('That user no longer exists.', 'danger')
                 return redirect(back)
 
+        # Track what actually moved. Re-deriving this after the commit by
+        # testing `issue.assigned_to == user.id` would also match the issues
+        # that were ALREADY assigned to that person — they were counted as
+        # skipped, but would still be emailed "assigned to you" every time
+        # anyone ran a bulk assign over them.
+        newly_assigned = []
         for issue in issues:
             if issue.assigned_to == (user.id if user else None):
                 skipped += 1
                 continue
             issue.assigned_to = user.id if user else None
+            newly_assigned.append(issue)
             changed += 1
         db.session.commit()
 
-        for issue in issues:
-            if issue.assigned_to == (user.id if user else None) and user:
+        if user:
+            for issue in newly_assigned:
                 notify(
                     recipient  = user,
                     title      = f'Issue #{issue.id} assigned to you',
@@ -1054,7 +1061,7 @@ def bulk_action():
                     event_type = EVENT_ISSUE_ASSIGNED,
                     send_email = True,
                 )
-        db.session.commit()   # notify() does not commit — rule 70
+            db.session.commit()   # notify() does not commit — rule 70
 
         label = user.display_name if user else 'Unassigned'
         log_action(ACTION_UPDATE, 'Issue', None, f'bulk assign → {label}',
@@ -1068,11 +1075,17 @@ def bulk_action():
             flash('Please choose a status to set.', 'warning')
             return redirect(back)
 
+        # (issue, old_status) for the audit pass, which must run AFTER the
+        # commit — log_action() commits internally (rule 41), so calling it
+        # inside this loop would commit each row separately and lose the
+        # batch's atomicity.
+        moved = []
         for issue in issues:
             if issue.status == new_status:
                 skipped += 1
                 continue
             old = issue.status
+            moved.append((issue, old))
             issue.status = new_status
             # Keep resolved_at consistent with the status, the same way the
             # single-issue update does — a resolved issue with no resolved_at
@@ -1082,14 +1095,16 @@ def bulk_action():
             elif new_status in ('open', 'in_progress'):
                 issue.resolved_at = None
             changed += 1
+        db.session.commit()
+        for issue, old in moved:
             log_action(ACTION_UPDATE, 'Issue', issue.id, f'#{issue.id}',
                        f'bulk status {old} → {new_status} by {current_user.username}')
-        db.session.commit()
         _flash_bulk(changed, skipped,
                     f'set to {new_status.replace("_", " ").title()}')
 
     # ── Verify & close ───────────────────────────────────────────────────
     elif action == 'verify':
+        verified = []
         for issue in issues:
             if issue.status not in ('resolved', 'pending_verification'):
                 skipped += 1
@@ -1099,10 +1114,12 @@ def bulk_action():
             issue.verified_at = now_eastern()
             if not issue.resolved_at:
                 issue.resolved_at = now_eastern()
+            verified.append(issue)
             changed += 1
+        db.session.commit()
+        for issue in verified:          # after the commit — rule 41
             log_action(ACTION_UPDATE, 'Issue', issue.id, f'#{issue.id}',
                        f'bulk_verified_by={current_user.username}')
-        db.session.commit()
         _flash_bulk(changed, skipped, 'verified and closed',
                     skip_reason='not awaiting verification')
 
@@ -1110,17 +1127,25 @@ def bulk_action():
     elif action == 'delete':
         from app.utils import storage
         photo_paths = []
+        # Snapshot the ids BEFORE deleting — the objects are expired after the
+        # commit, and the audit pass has to run after it (rule 41: log_action
+        # commits internally, so auditing inside this loop would commit the
+        # deletes one at a time and, on a mid-loop failure, leave rows gone
+        # with the photo cleanup below never reached).
+        deleted_ids = []
         for issue in issues:
             if issue.photo_path:
                 photo_paths.append(issue.photo_path)
             for lst in (issue.mobile_photo_paths, issue.result_photos):
                 if lst:
                     photo_paths.extend(lst)
-            log_action(ACTION_DELETE, 'Issue', issue.id, f'#{issue.id}',
-                       f'bulk deleted by {current_user.username}')
+            deleted_ids.append(issue.id)
             db.session.delete(issue)
             changed += 1
         db.session.commit()
+        for issue_id in deleted_ids:
+            log_action(ACTION_DELETE, 'Issue', issue_id, f'#{issue_id}',
+                       f'bulk deleted by {current_user.username}')
         # Files go only after the rows are safely gone — a failure here leaves
         # an orphaned file, which is recoverable; the reverse is not.
         for rel_path in photo_paths: