Public bug reported: The following series of curl commands creates a user with an email address of ‘z@example.org’, and then links 10 additional addresses to z@example.org curl -X POST --data "email=z@example.org&display_name=z" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users curl -X POST --data "email=z1@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z2@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z3@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z4@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z5@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z6@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z7@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z8@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z9@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses curl -X POST --data "email=z10@example.org" --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org/addresses A sqlite3 dump of the database shows the following in the addresses table: INSERT INTO "address" VALUES(11,'z@example.org',NULL,'z',NULL,'2015-02-08 10:50:37.241724',5,17); INSERT INTO "address" VALUES(12,'z1@example.org',NULL,'',NULL,'2015-02-08 10:52:08.928901',5,19); INSERT INTO "address" VALUES(13,'z2@example.org',NULL,'',NULL,'2015-02-08 10:52:36.308978',5,20); INSERT INTO "address" VALUES(14,'z3@example.org',NULL,'',NULL,'2015-02-08 10:52:43.947229',5,21); INSERT INTO "address" VALUES(15,'z4@example.org',NULL,'',NULL,'2015-02-08 10:52:49.598934',5,22); INSERT INTO "address" VALUES(16,'z5@example.org',NULL,'',NULL,'2015-02-08 10:52:54.406450',5,23); INSERT INTO "address" VALUES(17,'z6@example.org',NULL,'',NULL,'2015-02-08 10:52:59.295078',5,24); INSERT INTO "address" VALUES(18,'z7@example.org',NULL,'',NULL,'2015-02-08 10:53:04.892381',5,25); INSERT INTO "address" VALUES(19,'z8@example.org',NULL,'',NULL,'2015-02-08 10:53:10.497119',5,26); INSERT INTO "address" VALUES(20,'z9@example.org',NULL,'',NULL,'2015-02-08 10:53:16.450507',5,27); INSERT INTO "address" VALUES(21,'z10@example.org',NULL,'',NULL,'2015-02-08 10:53:24.021368',5,28); All good at this stage. No problems. The following curl command deletes user ‘z@example.org’ curl --verbose -X DELETE --header "authorization: Basic cmVzdGFkbWluOnJlc3RwYXNz" http://localhost:8001/3.0/users/z@example.org Strangely, a sqlite3 dump of the database now shows the following in the addresses table: INSERT INTO "address" VALUES(12,'z1@example.org',NULL,'',NULL,'2015-02-08 10:52:08.928901',NULL,19); INSERT INTO "address" VALUES(14,'z3@example.org',NULL,'',NULL,'2015-02-08 10:52:43.947229',NULL,21); INSERT INTO "address" VALUES(16,'z5@example.org',NULL,'',NULL,'2015-02-08 10:52:54.406450',NULL,23); INSERT INTO "address" VALUES(18,'z7@example.org',NULL,'',NULL,'2015-02-08 10:53:04.892381',NULL,25); INSERT INTO "address" VALUES(20,'z9@example.org',NULL,'',NULL,'2015-02-08 10:53:16.450507',NULL,27); So 6 of the addresses that should have been deleted were deleted, but 5 remain. The linked address deletion seems to be skipping addresses for some reason. It appears the problem is caused by the delete address functionality mutating the iterator of user addresses. This appears to fix the problem, which is in rest/users.py def on_delete(self, request, response): """Delete the named user, all her memberships, and addresses.""" if self._user is None: not_found(response) return for member in self._user.memberships.members: member.unsubscribe() user_manager = getUtility(IUserManager) addresses_for_deletion = [] for address in self._user.addresses: # to avoid mutating the self._user.addresses iterator, create a separate list of addresses addresses_for_deletion.append(address) for address in addresses_for_deletion: user_manager.delete_address(address) user_manager.delete_user(self._user) no_content(response) ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1419519 Title: REST API delete user function does not delete every 2nd linked address To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1419519/+subscriptions