MySQL Bugs: #43553: MySql web role provider does not remove users from roles

Bug #43553	MySql web role provider does not remove users from roles
Submitted:	11 Mar 10:05	Modified:	3 Apr 18:45
Reporter:	Ermete Gaudenzi
Status:	Closed
Category:	Connector/Net	Severity:	S2 (Serious)
Version:	5.2.3, 5.2.5	OS:	Microsoft Windows (dotnet 2.0)
Assigned to:		Target Version:
Tags:	web, membership, provider, roles
Triage:	D2 (Serious)

Description:
When is requested to MySql role provider to remove a user from a role,
it does not remove remove it.
The query log shows the query is correctly executed within a transaction which is is
immediately rolled back.

The rollback is caused by a missing call to transaction complete method.
See suggested fix for further details.

How to repeat:
in a web-application with existing user "user":

Roles.CreateRole("test");
bool before = Roles.IsUserInRole("user", "test"); //=false
Roles.AddUserToRole("user", "test");
Roles.RemoveUserFromRole("user", "test");
bool after = Roles.IsUserInRole("user", "test"); //=true

Suggested fix:
in version 5.2.5:
in file:
MySql.Web\Providers\Source\RoleProvider.cs

add at line 456, after "using(MySqlConnection...)" block:
ts.Complete();

like in the AddUsersToRoles() method

Hi Ermete and thanks for spotting this!

Truly, look into code shows that:
public override bool DeleteRole(string rolename, bool throwOnPopulatedRole) and
public override void RemoveUsersFromRoles(string[] usernames, string[] rolenames)
do not have ts.complete().

Verified as described by looking into latest sources.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/70850

fixed in 5.2.6

An entry was added to the 5.2.6 changelog:

Requests sent to the Connector/NET role provider to remove a user from a role failed. The
query log showed the query was correctly executed within a transaction which was
immediately rolled back. The rollback was caused by a missing call to the Complete method
of the transaction.