rootninja

Easy, just go into the database and delete the row from mwuser, right? wrong. If you’re using phpPgAdmin pgadmin3 or some other tool, you should get a nice message letting you know exactly which constraint would be violated if it actually let you do that dave. In my case, I had a user that had updated a few pages, so I just needed to change the revision table so that he wasn’t referenced anymore.

$ sudo psql -U user -d db

Welcome to psql 8.3.6, the PostgreSQL interactive terminal.

Type:  \copyright for distribution terms
       \h for help with SQL commands
       \? for help with psql commands
       \g or terminate with semicolon to execute query
       \q to quit

db=>

I’ll look at all the users, and then use the columns that describe the user I want to delete to update the rows in the revision table.

db=> select user_id, user_name, user_real_name, user_email from mwuser;

 user_id | user_name | user_real_name |       user_email
---------+-----------+----------------+-------------------------
       8 | Tburton   | Tim Burton     | burton@domain.com
       9 | Ajackson  | Andy Kelso     | jack@domain.com
       2 | Mtyson    | Mike Tyson     | tyson@domain.com
(4 rows)

Select the rows in the revision table where rev_user matches the user_id of the user you want to delete.

db=> select rev_user, rev_user_text from revision where rev_user = ‘8′;

 rev_id | rev_page | rev_user | rev_user_text
----------+---------------
        8 | Tburton
        8 | Tburton
        8 | Tburton
(3 rows)

The rows returned are the ones that need to be modified before you can delete the user. The easiest way to fix this is to update the rows and change the id and name to a different user.

db => update revision

set rev_user_text = ‘Mtyson’

where rev_user_text = ‘Tburton’;

UPDATE 3

db => update revision

set rev_user = ‘2′

where rev_user = ‘8′;

UPDATE 3

Now you can delete the user from mwuser.

db => delete from mwuser

where user_name = ‘Tburton’;

DELETE 1

Now when you look at the revisions, you’ll see that it was in fact Mike Tyson that updated page xyz, and not Tim Burton! So if anyone has access to the wiki database and the wiki database user account, you can see it would be pretty easy to cause some chaos.