From 5f37aae990e3c9be4d285d3ed79e0a7ae1a721ac Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Fri, 30 Aug 2019 11:49:38 +0200
Subject: [PATCH] Add a queue to setMetadata to aovid race conditions

---
 rpc.js | 69 +++++++++++++++++++++++++++++++++++-----------------------
 1 file changed, 42 insertions(+), 27 deletions(-)

diff --git a/rpc.js b/rpc.js
index 32afa4f30..7f0e7732b 100644
--- a/rpc.js
+++ b/rpc.js
@@ -340,6 +340,7 @@ var getMetadata = function (Env, channel, cb) {
         value: value
     }
 */
+var metadataSem = Saferphore.create(1);
 var setMetadata = function (Env, data, unsafeKey, cb) {
     var channel = data.channel;
     var command = data.command;
@@ -347,39 +348,53 @@ var setMetadata = function (Env, data, unsafeKey, cb) {
     if (!command || typeof (command) !== 'string') { return void cb ('INVALID_COMMAND'); }
     if (Meta.commands.indexOf(command) === -1) { return void('UNSUPPORTED_COMMAND'); }
 
-    getMetadata(Env, channel, function (err, metadata) {
-        if (err) { return void cb(err); }
-        if (!(metadata && Array.isArray(metadata.owners))) { return void cb('E_NO_OWNERS'); }
-
-        // Confirm that the channel is owned by the user in question
-        // or the user is accepting a pending ownerhsip offer
-        if (metadata.pending_owners && Array.isArray(metadata.pending_owners) &&
-                    metadata.pending_owners.indexOf(unsafeKey) !== -1 &&
-                    metadata.owners.indexOf(unsafeKey) === -1) {
-
-            // If you are a pending owner, make sure you can only add yourelf as an owner
-            if (command !== 'ADD_OWNERS' || !Array.isArray(data.value) || data.value.length !== 1
-                    || data.value[0] !== unsafeKey) {
-                return void cb('INSUFFICIENT_PERMISSIONS');
+    metadataSem.take(function (give) {
+        var g = give();
+        getMetadata(Env, channel, function (err, metadata) {
+            if (err) {
+                g();
+                return void cb(err);
+            }
+            if (!(metadata && Array.isArray(metadata.owners))) {
+                g();
+                return void cb('E_NO_OWNERS');
             }
 
-        } else if (metadata.owners.indexOf(unsafeKey) === -1) {
-            return void cb('INSUFFICIENT_PERMISSIONS');
-        }
+            // Confirm that the channel is owned by the user in question
+            // or the user is accepting a pending ownerhsip offer
+            if (metadata.pending_owners && Array.isArray(metadata.pending_owners) &&
+                        metadata.pending_owners.indexOf(unsafeKey) !== -1 &&
+                        metadata.owners.indexOf(unsafeKey) === -1) {
+
+                // If you are a pending owner, make sure you can only add yourelf as an owner
+                if (command !== 'ADD_OWNERS' || !Array.isArray(data.value)
+                        || data.value.length !== 1
+                        || data.value[0] !== unsafeKey) {
+                    g();
+                    return void cb('INSUFFICIENT_PERMISSIONS');
+                }
 
-        // Add the new metadata line
-        var line = [command, data.value, +new Date()];
-        try {
-            Meta.handleCommand(metadata, line);
-        } catch (e) {
-            return void cb(e);
-        }
+            } else if (metadata.owners.indexOf(unsafeKey) === -1) {
+                g();
+                return void cb('INSUFFICIENT_PERMISSIONS');
+            }
 
-        return void Env.msgStore.writeMetadata(channel, JSON.stringify(line), function (e) {
-            if (e) {
+            // Add the new metadata line
+            var line = [command, data.value, +new Date()];
+            try {
+                Meta.handleCommand(metadata, line);
+            } catch (e) {
+                g();
                 return void cb(e);
             }
-            cb(void 0, metadata);
+
+            Env.msgStore.writeMetadata(channel, JSON.stringify(line), function (e) {
+                g();
+                if (e) {
+                    return void cb(e);
+                }
+                cb(void 0, metadata);
+            });
         });
     });
 };