[3.0 & 2.1]: Duplicate packages in pacman - Missing token check?

[sbulen]

Basic Information

If users click back while installing a mod, & try again, they get duplicate entries in pacman.

Shouldn't the token check prevent this from happening? I also thought there was a uniqueness check...

The duplicate entries have been reported several times this morning on the forum:
https://www.simplemachines.org/community/index.php?msg=4191163

Steps to reproduce

1. Attempt to install an SMF patch
2. Instead of hitting "Proceed", hit your browser's BACK button...
3. Attempt to install an SMF patch
4. Instead of hitting "Proceed", hit your browser's BACK button...
5. Attempt to install an SMF patch & hit OK this time...

We've seen a few of these as folks attempt to install the 2.1.5 patch & experience various errors.

I've confirmed in 2.1, I suspect (& have not yet confirmed) 3.0 will do the same.

Expected result

One successful install

Actual result

Duplicate entries in pacman as depicted above

Version/Git revision

2.1.5

Database Engine

All

Database Version

8.4.4

PHP Version

8.4.5

Logs

Additional Information

No response

[jdarwood007]

It shouldn't do that at all. Do you have multiple files in your packages folder?

[sbulen]

Yep:

[sbulen]

Unix also:

[jdarwood007]

That seems to be why. I haven't seen the code in a while, but pacman was only checking inside for package-info and to find the package id, and that was the match. Since it matched multiple times, it matches the data up from the installed data multiple times.

[sbulen]

I see three issues here:

• The package ID should prevent the dupe... That check happens today only when you use the "Add Packages" form. It doesn't happen downloading from SMF. Or, for that matter, after hitting the BACK button...
• Tokens are supposed to prevent such issues via the BACK button. You should get an invalid token error, which would cause you to refresh the screen and see the already-existing package.
• The "update your forum" link appears even when you have the package downloaded already. If you hit that link, you get another.

It's in log_packages that way also: