From 7994e3255df86e0a2d780cbf530ca560ef77a3a3 Mon Sep 17 00:00:00 2001 From: Philippe PATEY Date: Mon, 6 Jul 2026 15:52:31 +0200 Subject: [PATCH] [FIX] alerts: pristine-alerts comparison + Celery session/pool reset after fork --- source/app/blueprints/rest/v2/alerts.py | 7 +++++-- source/app/iris_engine/module_handler/module_handler.py | 4 ++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/source/app/blueprints/rest/v2/alerts.py b/source/app/blueprints/rest/v2/alerts.py index 7a16dcfce..4ed91f442 100644 --- a/source/app/blueprints/rest/v2/alerts.py +++ b/source/app/blueprints/rest/v2/alerts.py @@ -48,6 +48,8 @@ from app.models.errors import BusinessProcessingError from app.models.errors import ObjectNotFoundError +import copy + # Fields that must be immutable on alert update. See GHSA-8hwq-v6vm-9grr # / SBA-ADV-20260128-05 / CWE-863 — re-attributing alert_customer_id lets @@ -252,6 +254,7 @@ def update(self, identifier): identifier, fallback_customer_access=ac_current_user_has_customer_access ) + pristine_alert = copy.copy(alert) # shallow copy for ongoing comparison # Drop fields the caller must not be allowed to change on update # (GHSA-8hwq-v6vm-9grr / SBA-ADV-20260128-05 / CWE-863). The # customer_id is the worst: re-attributing an alert to a @@ -262,7 +265,7 @@ def update(self, identifier): activity_data = [] for key, value in request_data.items(): - old_value = getattr(alert, key, None) + old_value = getattr(pristine_alert, key, None) if type(old_value) is int: old_value = str(old_value) @@ -279,7 +282,7 @@ def update(self, identifier): if request_data.get('alert_owner_id') == "-1" or request_data.get('alert_owner_id') == -1: updated_alert.alert_owner_id = None - result = alerts_update(alert, updated_alert, activity_data) + result = alerts_update(pristine_alert, updated_alert, activity_data) return response_api_success(self._schema.dump(result)) except ValidationError as e: diff --git a/source/app/iris_engine/module_handler/module_handler.py b/source/app/iris_engine/module_handler/module_handler.py index d47f78051..b43cbf764 100644 --- a/source/app/iris_engine/module_handler/module_handler.py +++ b/source/app/iris_engine/module_handler/module_handler.py @@ -423,6 +423,10 @@ def task_hook_wrapper(self, module_name, hook_name, hook_ui_name, data, init_use :param caseid: Case associated :return: A task status JSON task_success or task_failure """ + # Reset session and connection pool inherited from parent process fork + db.session.remove() + db.engine.dispose() + try: # Data is serialized, so deserialized signature, pdata = data.encode("utf-8").split(b" ")