Removing an account leaves the feeds only they read downloading for no one #157
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found in a code audit on 2026-10-09.
Removing an account (
DELETE /api/users/{id},src/web.rs:544-563, andipx user rm,src/main.rs:474) deletes the user, and the foreign keys take their subscriptions, read state, block lists and hidden items with them. What unsubscribing in the page does next (remove_feed,src/web.rs:1659-1693) is skipped: a feed nobody subscribes to any more stays in the catalogue.A feed with no subscribers is scanned daily and downloads by its own settings (
merge_policy's single-user case, auto_download on by default), so every feed only that person read goes on downloading each new episode, for no one, until it has been quiet for a year (clean_directory).Fix: before deleting the account, leave each of their feeds the way
remove_feeddoes.Fixed in
33e031d: remove_feed's body is leave(), and remove_user() leaves each of the person's feeds before deleting the account, from the page andipx user rm, which now also tells a running daemon to reload. Test: a_removed_account_takes_the_feeds_only_it_read_with_it. Deployed as 0.10.3-dev on 2026-10-09.