Consider the current logged-in user for active users tracking
Before this change, the user tracked for freshening the set
of active users was the one checked for group ownership, which
may or may not be the user actively using Gerrit.
A user admin scanning the permissions of all users could therefore
trigger implicitly the including of all accounts as active, which
would not be the case.
Fetch the current thread active user and use that account id
for tracking the activity, rather than the account passed as
paramemter for membership check.
Change-Id: Id38e0bb5fd6f41effde9c76055c2f1daeab3a983
diff --git a/admin/track-and-disable-inactive-users-1.3.groovy b/admin/track-and-disable-inactive-users-1.3.groovy
index edc0f0c..b74bdd6 100644
--- a/admin/track-and-disable-inactive-users-1.3.groovy
+++ b/admin/track-and-disable-inactive-users-1.3.groovy
@@ -73,6 +73,9 @@
@Named(TrackActiveUsersCache.NAME)
Cache<Integer, Long> trackActiveUsersCache
+ @Inject
+ Provider<CurrentUser> currentUserProvider
+
@Override
boolean handles(AccountGroup.UUID uuid) {
return true
@@ -90,8 +93,10 @@
@Override
GroupMembership membershipsOf(CurrentUser user) {
- if (user.identifiedUser) {
- def accountId = user.accountId.get()
+ def currentUser = currentUserProvider.get()
+
+ if (currentUser.identifiedUser) {
+ def accountId = currentUser.accountId.get()
def currentMinutes = MILLISECONDS.toMinutes(System.currentTimeMillis())
if (trackActiveUsersCache.getIfPresent(accountId) != currentMinutes) {
trackActiveUsersCache.put(accountId, currentMinutes)
