Merge remote-tracking branch 'bmo/master' into unstable

27 files changed, 383 insertions, 51 deletions

diff --git a/.circleci/build.sh b/.circleci/build.sh
new file mode 100644
index 000000000..7d476c85d
--- /dev/null
+++ b/.circleci/build.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -euf -o pipefail
+
+docker build \
+    --build-arg CI="$CI" \
+    --build-arg CIRCLE_SHA1="$CIRCLE_SHA1" \
+    --build-arg CIRCLE_BUILD_URL="$CIRCLE_BUILD_URL" \
+    -t bmo .
+
+docker run --name bmo --entrypoint true bmo
+docker cp bmo:/app/version.json build_info/version.json
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7183001b9..f5b35833a 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -5,13 +5,6 @@
 
 version: 2
 
-main_filters: &main_filters
-  branches:
-    ignore:
-      - /^(?:release|test)-20\d\d\d\d\d\d\.\d+/
-      - /\//
-      - production
-
 defaults:
   bmo_slim_image: &bmo_slim_image
     image: bugzilla/harmony-slim:20180318.1
@@ -20,6 +13,18 @@ defaults:
   mysql_image: &mysql_image
     image: mozillabteam/bmo-mysql:5.6
 
+  store_log: &store_log
+    store_artifacts:
+      path: /app/bugzilla.log
+      destination: bugzilla.log
+
+  main_filters: &main_filters
+    branches:
+      ignore:
+        - /^(?:release|test)-20\d\d\d\d\d\d\.\d+/
+        - /\//
+        - production
+
   bmo_env: &bmo_env
     PORT: 8000
     LOGGING_PORT: 5880
@@ -83,12 +88,19 @@ jobs:
             --build-arg CIRCLE_SHA1="$CIRCLE_SHA1" \
             --build-arg CIRCLE_BUILD_URL="$CIRCLE_BUILD_URL" \
             -t bmo .
+      - attach_workspace:
+          at: /app/build_info
+      - run: "docker run --name bmo --entrypoint true bmo"
+      - run: "docker cp bmo:/app/version.json build_info/version.json"
+      - store_artifacts:
+          path: /app/build_info
+      - *store_log
       - deploy:
           command: |
             exit 0
 
   test_sanity:
-    parallelism: 2
+    parallelism: 1
     working_directory: /app
     docker:
       - <<: *bmo_slim_image
@@ -106,6 +118,7 @@ jobs:
             /app/scripts/entrypoint.pl prove -qf $(circleci tests glob 't/*.t' | circleci tests split) | tee artifacts/$CIRCLE_JOB.txt
       - store_artifacts:
           path: /app/artifacts
+      - *store_log
 
   test_webservices:
     parallelism: 1
@@ -120,6 +133,7 @@ jobs:
           /app/scripts/entrypoint.pl test_webservices | tee artifacts/$CIRCLE_JOB.txt
       - store_artifacts:
           path: /app/artifacts
+      - *store_log
 
   test_selenium:
     parallelism: 1
@@ -134,6 +148,7 @@ jobs:
           /app/scripts/entrypoint.pl test_selenium | tee artifacts/$CIRCLE_JOB.txt
       - store_artifacts:
           path: /app/artifacts
+      - *store_log
 
   test_bmo:
     parallelism: 1
@@ -159,6 +174,7 @@ jobs:
           mkdir artifacts
       - run: |
           /app/scripts/entrypoint.pl test_bmo -q -f t/bmo/*.t
+      - *store_log
 
 workflows:
   version: 2
diff --git a/.circleci/deploy.sh b/.circleci/deploy.sh
new file mode 100644
index 000000000..3d8a3852f
--- /dev/null
+++ b/.circleci/deploy.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -euf -o pipefail
+
+[[ -n "$DOCKERHUB_REPO" && -n "$DOCKER_USER" && -n "$DOCKER_PASS" ]] || exit 0
+docker login -u "$DOCKER_USER" -p "$DOCKER_PASS"
+
+if [[ "$CIRCLE_BRANCH" == "master" ]]; then
+    TAG="$(cat /app/build_info/tag.txt)"
+    [[ -n "$GITHUB_PERSONAL_TOKEN" ]] || exit 0
+    if [[ -n "$TAG" && -f build_info/publish.txt ]]; then
+    git config credential.helper "cache --timeout 120"
+    git config user.email "$GITHUB_EMAIL"
+    git config user.name "$GITHUB_NAME"
+    git tag $TAG
+    git push https://${GITHUB_PERSONAL_TOKEN}:x-oauth-basic@github.com/$GITHUB_REPO.git $TAG
+    docker tag bmo "$DOCKERHUB_REPO:$TAG"
+    docker push "$DOCKERHUB_REPO:$TAG"
+    fi
+    docker tag bmo "$DOCKERHUB_REPO:latest"
+    docker push "$DOCKERHUB_REPO:latest"
+elif [[ "$CIRCLE_BRANCH" == "development" ]]; then
+    docker tag bmo "$DOCKERHUB_REPO:build-${CIRCLE_BUILD_NUM}"
+    docker push "$DOCKERHUB_REPO:build-${CIRCLE_BUILD_NUM}"
+fi
diff --git a/.mailmap b/.mailmap
new file mode 100644
index 000000000..1aa350e1b
--- /dev/null
+++ b/.mailmap
@@ -0,0 +1,85 @@
+Byron Jones <glob@mozilla.com> Byron Jones <bjones@mozilla.com>
+Byron Jones <glob@mozilla.com> bugzilla%glob.com.au <>
+Byron Jones <glob@mozilla.com> byron jones (glob) <bugzilla@glob.com.au>
+Byron Jones <glob@mozilla.com> Byron Jones ‹:glob› <glob@mozilla.com>
+Byron Jones <glob@mozilla.com> byron jones <byron@glob.com.au>
+Dave Miller <justdave@mozilla.com> justdave%bugzilla.org <>
+Dave Miller <justdave@mozilla.com> justdave%syndicomm.com <>
+David Lawrence <dkl@mozilla.com> Dave Lawrence <dkl@redhat.com>
+David Lawrence <dkl@mozilla.com> Dave Lawrence <dlawrence@mozilla.com>
+David Lawrence <dkl@mozilla.com> David Lawrence <dkl@redhat.com>
+David Lawrence <dkl@mozilla.com> dklawren <dklawren@users.noreply.github.com>
+David Lawrence <dkl@mozilla.com> David Lawrence <dlawrence@mozilla.com>
+David Lawrence <dkl@mozilla.com> dkl%redhat.com <>
+David Lawrence <dkl@mozilla.com> David Lawrence [:dkl] <dkl@mozilla.com>
+David Lawrence <dkl@mozilla.com> Dave Lawrence <dkl@mozilla.com>
+Dylan Hardison <dylan@mozilla.com> Dylan Hardison <dylan@hardison.net>
+Dylan Hardison <dylan@mozilla.com> Dylan William Hardison <dylan@hardison.net>
+Dylan Hardison <dylan@mozilla.com> Dylan William Hardison <dylan@mozill.com>
+Dylan Hardison <dylan@mozilla.com> Dylan William Hardison <dylan@mozilla.com>
+Dylan Hardison <dylan@mozilla.com> Dylan William Hardison [:dylan] <dylan@mozilla.com>
+Frédéric Buclin <LpSolit@gmail.com> lpsolit%gmail.com <>
+Gervase Markham <gerv@gerv.net> Gervase Markham <gerv@mozilla.org>
+Gervase Markham <gerv@gerv.net> gerv%gerv.net <>
+Max Kanat-Alexander <mkanat@bugzilla.org> mkanat%bugzilla.org <>
+Max Kanat-Alexander <mkanat@bugzilla.org> mkanat%kerio.com <>
+Simon Green <mail@simon.green> Simon Green <sgreen+mozilla@redhat.com>
+Simon Green <mail@simon.green> Simon Green <simon@simongreen.net>
+Terry <terry@mozilla.org> terry%mozilla.org <>
+Terry <terry@mozilla.org> terry%netscape.com <>
+eseyman <eseyman@linagora.com> eseyman%linagora.com <>
+<koosha.khajeh@gmail.com> <Koosha>
+
+A. Shimono (himorin) <shimono@bug-ja.org> A. Shimono <shimono@bug-ja.org>
+A. Shimono (himorin) <shimono@bug-ja.org> A. Shimono [:himorin] <shimono@bug-ja.org>
+Teemu Mannermaa <wicked@sci.fi> wicked%sci.fi <>
+
+bbaetz <bbaetz@acm.org> bbaetz%acm.org <>
+bbaetz <bbaetz@acm.org> bbaetz%cs.mcgill.ca <>
+bbaetz <bbaetz@acm.org> bbaetz%student.usyd.edu.au <>
+
+barnboy <barnboy@trilobyte.net> barnboy%trilobyte.net <>
+blakeross <blakeross@telocity.com> blakeross%telocity.com <>
+bryce-mozilla <bryce-mozilla@nextbus.com> bryce-mozilla%nextbus.com <>
+bugreport <bugreport@peshkin.net> bugreport%peshkin.net <>
+burnus <burnus@gmx.de> burnus%gmx.de <>
+caillon <caillon@returnzero.com> caillon%returnzero.com <>
+cyeh <cyeh@bluemartini.com> cyeh%bluemartini.com <>
+dave <dave@intrec.com> dave%intrec.com <>
+db48x <db48x@yahoo.com> db48x%yahoo.com <>
+dmose <dmose@mozilla.org> dmose%mozilla.org <>
+donm <donm@bluemartini.com> donm%bluemartini.com <>
+endico <endico@mozilla.org> endico%mozilla.org <>
+erik <erik@dasbistro.com> erik%dasbistro.com <>
+ghendricks <ghendricks@novell.com> ghendricks%novell.com <>
+guy.pyrzak <guy.pyrzak@gmail.com> guy.pyrzak%gmail.com <>
+harrison <harrison@netscape.com> harrison%netscape.com <>
+jake <jake@acutex.net> jake%acutex.net <>
+jake <jake@bugzilla.org> jake%bugzilla.org <>
+jeff.hedlund <jeff.hedlund@matrixsi.com> jeff.hedlund%matrixsi.com <>
+jkeiser <jkeiser@netscape.com> jkeiser%netscape.com <>
+jocuri <jocuri@softhome.net> jocuri%softhome.net <>
+john <john@johnkeiser.com> john%johnkeiser.com <>
+jouni <jouni@heikniemi.net> jouni%heikniemi.net <>
+jwz <jwz@mozilla.org> jwz%mozilla.org <>
+karl <karl@kornel.name> karl%kornel.name <>
+karl.kornel <karl.kornel@mindspeed.com> karl.kornel%mindspeed.com <>
+kiko <kiko@async.com.br> kiko%async.com.br <>
+matty <matty@chariot.net.au> matty%chariot.net.au <>
+mbarnson <mbarnson@excitehome.net> mbarnson%excitehome.net <>
+mbarnson <mbarnson@sisna.com> mbarnson%sisna.com <>
+mcafee <mcafee@netscape.com> mcafee%netscape.com <>
+mozilla <mozilla@colinogilvie.co.uk> mozilla%colinogilvie.co.uk <>
+myk <myk@mozilla.org> myk%mozilla.org <>
+olav <olav@bkor.dhs.org> olav%bkor.dhs.org <>
+preed <preed@sigkill.com> preed%sigkill.com <>
+reed <reed@reedloden.com> reed%reedloden.com <>
+seth <seth@cs.brandeis.edu> seth%cs.brandeis.edu <>
+shaver <shaver@netscape.com> shaver%netscape.com <>
+tara <tara@tequilarista.org> tara%tequilarista.org <>
+timeless <timeless@mac.com> timeless%mac.com <>
+timeless <timeless@mozdev.org> timeless%mozdev.org <>
+travis <travis@sedsystems.ca> travis%sedsystems.ca <>
+vladd <vladd@bugzilla.org> vladd%bugzilla.org <>
+wurblzap <wurblzap@gmail.com> wurblzap%gmail.com <>
+zach <zach@zachlipton.com> zach%zachlipton.com <>
diff --git a/Bugzilla/JobQueue.pm b/Bugzilla/JobQueue.pm
index 53b088c6e..afb36673f 100644
--- a/Bugzilla/JobQueue.pm
+++ b/Bugzilla/JobQueue.pm
@@ -101,7 +101,12 @@ sub debug {
     my $caller_pkg = caller;
     local $Log::Log4perl::caller_depth = $Log::Log4perl::caller_depth + 1;
     my $logger = Log::Log4perl->get_logger($caller_pkg);
-    $logger->info(@args);
+    if ($args[0] && $args[0] eq "TheSchwartz::work_once found no jobs") {
+        $logger->trace(@args);
+    }
+    else {
+        $logger->info(@args);
+    }
 }
 
 sub work {
diff --git a/Bugzilla/WebService/Bugzilla.pm b/Bugzilla/WebService/Bugzilla.pm
index 0d0393c28..145502445 100644
--- a/Bugzilla/WebService/Bugzilla.pm
+++ b/Bugzilla/WebService/Bugzilla.pm
@@ -13,7 +13,10 @@ use warnings;
 
 use base qw(Bugzilla::WebService);
 use Bugzilla::Constants;
+use Bugzilla::Error;
+use Bugzilla::Logging;
 use Bugzilla::Util qw(datetime_from);
+use Try::Tiny;
 
 use DateTime;
 
@@ -28,6 +31,7 @@ use constant READ_ONLY => qw(
     timezone
     time
     version
+    jobqueue_status
 );
 
 use constant PUBLIC_METHODS => qw(
@@ -35,6 +39,7 @@ use constant PUBLIC_METHODS => qw(
     time
     timezone
     version
+    jobqueue_status
 );
 
 sub version {
@@ -80,6 +85,39 @@ sub time {
     };
 }
 
+sub jobqueue_status {
+    my ( $self, $params ) = @_;
+    
+    Bugzilla->login(LOGIN_REQUIRED);
+
+    my $dbh = Bugzilla->dbh;
+    my $query = q{
+        SELECT
+            COUNT(*) AS total,
+            COALESCE(
+                (SELECT COUNT(*)
+                    FROM ts_error
+                    WHERE ts_error.jobid = j.jobid
+                ) 
+            , 0) AS errors
+        FROM ts_job j
+            INNER JOIN ts_funcmap f
+                ON f.funcid = j.funcid;
+    };
+
+    my $status;
+    try {
+        $status = $dbh->selectrow_hashref($query);
+        $status->{errors} = 0 + $status->{errors};
+        $status->{total}  = 0 + $status->{total};
+    } catch {
+        ERROR($_);
+        ThrowCodeError('jobqueue_status_error');
+    };
+
+    return $status;
+}
+
 1;
 
 __END__
diff --git a/Bugzilla/WebService/Constants.pm b/Bugzilla/WebService/Constants.pm
index 93fddfc2b..71435c13a 100644
--- a/Bugzilla/WebService/Constants.pm
+++ b/Bugzilla/WebService/Constants.pm
@@ -199,6 +199,9 @@ use constant WS_ERROR_CODE => {
     # BugUserLastVisited errors
     user_not_involved => 1300,
 
+    # Job queue errors 1400-1500
+    jobqueue_status_error => 1400,
+
     # Errors thrown by the WebService itself. The ones that are negative
     # conform to http://xmlrpc-epi.sourceforge.net/specs/rfc.fault_codes.php
     xmlrpc_invalid_value => -32600,
diff --git a/Bugzilla/WebService/Server/REST/Resources/Bugzilla.pm b/Bugzilla/WebService/Server/REST/Resources/Bugzilla.pm
index a8f3f9330..646355cd3 100644
--- a/Bugzilla/WebService/Server/REST/Resources/Bugzilla.pm
+++ b/Bugzilla/WebService/Server/REST/Resources/Bugzilla.pm
@@ -49,6 +49,11 @@ sub _rest_resources {
             GET => {
                 method => 'parameters'
             }
+        },
+        qr{^/jobqueue_status$}, {
+            GET => {
+                method => 'jobqueue_status'
+            }
         }
     ];
     return $rest_resources;
diff --git a/README.rst b/README.rst
index 64fae335b..adeb1a18e 100644
--- a/README.rst
+++ b/README.rst
@@ -80,6 +80,22 @@ or db is changed, do a full provision:
 
     vagrant rsync && vagrant provision
 
+Testing Auth delegation
+-----------------------
+
+For testing auth-delegation there is included an `scripts/auth-test-app`
+script that runs a webserver and implements the auth delegation protocol.
+
+Provided you have `Mojolicious`_ installed:
+
+.. code-block:: bash
+  perl auth-test-app daemon
+
+Then just browse to `localhost:3000`_ to test creating API keys.
+
+.. _`Mojolicious`: https://metacpan.org/pod/Mojolicious
+.. _`localhost:3000`: http://localhost:3000
+
 Technical Details
 -----------------
 
diff --git a/conf/log4perl-test.conf b/conf/log4perl-test.conf
index eda81d31b..65558ba4f 100644
--- a/conf/log4perl-test.conf
+++ b/conf/log4perl-test.conf
@@ -1,4 +1,4 @@
-log4perl.rootLogger = DEBUG, Cereal, Screen
+log4perl.rootLogger = DEBUG, Cereal, Screen, File
 log4perl.appender.Cereal = Log::Log4perl::Appender::Socket
 log4perl.appender.Cereal.PeerAddr=127.0.0.1
 log4perl.appender.Cereal.PeerPort=5880
@@ -10,4 +10,9 @@ log4perl.filter.IS_INTERACTIVE = sub { Bugzilla::Logging::is_interactive() }
 log4perl.appender.Screen = Log::Log4perl::Appender::Screen
 log4perl.appender.Screen.Filter = IS_INTERACTIVE
 log4perl.appender.Screen.layout = Log::Log4perl::Layout::PatternLayout
-log4perl.appender.Screen.layout.ConversionPattern = %-5.5p [%d] [%c] %m{chomp} at %F line %L (%M)%n
\ No newline at end of file
+log4perl.appender.Screen.layout.ConversionPattern = %-5.5p [%d] [%c] %m{chomp} at %F line %L (%M)%n
+
+log4perl.appender.File = Log::Log4perl::Appender::File
+log4perl.appender.File.layout = Log::Log4perl::Layout::Mozilla
+log4perl.appender.File.filename = /app/bugzilla.log
+log4perl.appender.File.mode = append
diff --git a/docs/en/rst/api/core/v1/bugzilla.rst b/docs/en/rst/api/core/v1/bugzilla.rst
index 2dd40e0cb..e43472c30 100644
--- a/docs/en/rst/api/core/v1/bugzilla.rst
+++ b/docs/en/rst/api/core/v1/bugzilla.rst
@@ -300,3 +300,32 @@ name             type    description
 ===============  ======  ====================================================
 last_audit_time  string  The maximum of the at_time from the audit_log.
 ===============  ======  ====================================================
+
+Job Queue Status
+----------------
+
+Reports the status of the job queue.
+
+**Request**
+
+.. code-block:: text
+
+   GET /rest/jobqueue_status
+
+This method requires an authenticated user. 
+
+**Response**
+
+.. code-block:: js
+
+   {
+     "total": 12,
+     "errors": 0
+   }
+
+===============  =======  ====================================================
+name             type     description
+===============  =======  ====================================================
+total            integer  The total number of jobs in the job queue.
+errors           integer  The number of errors produced by jobs in the queue.
+===============  =======  ====================================================
\ No newline at end of file
diff --git a/js/instant-search.js b/js/instant-search.js
index 946f8ccfc..6e8f104f2 100644
--- a/js/instant-search.js
+++ b/js/instant-search.js
@@ -150,10 +150,12 @@ YAHOO.bugzilla.instantSearch = {
           product: YAHOO.bugzilla.instantSearch.getProduct(),
           summary: query,
           limit: 20,
-          include_fields: [ "id", "summary", "status", "resolution", "component" ],
-          Bugzilla_api_token : (BUGZILLA.api_token ? BUGZILLA.api_token : '')
+          include_fields: [ "id", "summary", "status", "resolution", "component" ]
         }
       };
+      if (BUGZILLA.api_token) {
+        jsonObject.params.Bugzilla_api_token = BUGZILLA.api_token;
+      }
 
       YAHOO.bugzilla.instantSearch.dataTable.getDataSource().sendRequest(
         YAHOO.lang.JSON.stringify(jsonObject), 
diff --git a/scripts/auth-test-app b/scripts/auth-test-app
new file mode 100755
index 000000000..3df56796c
--- /dev/null
+++ b/scripts/auth-test-app
@@ -0,0 +1,72 @@
+#!/usr/bin/perl
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+use 5.10.1;
+use strict;
+use warnings;
+use Mojolicious::Lite;
+use Digest::SHA qw(sha256_hex);
+
+my $BUGZILLA_URL = $ENV{AUTH_TEST_BUGZILLA_URL} // 'http://bmo-web.vm/auth.cgi';
+my $APP_DESC     = $ENV{AUTH_TEST_APP_DESC} // 'AuthTest';
+my %SECRETS;
+
+get '/' => sub {
+    my $c = shift;
+    my $callback_url = $c->url_for->to_abs->path('/callback');
+    my $app_id       = sha256_hex($callback_url, $APP_DESC);
+    $c->render(
+        template     => 'index',
+        app_id       => $app_id,
+        callback_url => $callback_url,
+        bugzilla_url => $BUGZILLA_URL,
+        app_desc     => $APP_DESC,
+    );
+};
+
+post '/callback' => sub {
+    my $c = shift;
+    %SECRETS = %{ $c->req->json };
+    $c->render( json => { result => 'SECRETS' } );
+};
+
+get '/callback' => sub {
+    my $c         = shift;
+    my $store_key = $c->param('callback_result');
+    $c->render( template => 'callback', %SECRETS );
+};
+
+app->start;
+__DATA__
+
+@@ index.html.ep
+% layout 'default';
+% title 'Configure';
+
+<p>Test auth delegation. <code>$app_id = <%= $app_id %></code></p>
+
+<form method="get" action="<%= $bugzilla_url %>">
+  <input type="hidden" name="callback" value="<%= $callback_url %>">
+  <input type="hidden" name="description" value="<%= $app_desc %>">
+  <input type="submit" value="Login">
+  </div>
+</form>
+
+@@ callback.html.ep
+% layout 'default';
+% title 'Login Result';
+
+<div><b>Login</b> <%= $client_api_login %> </div>
+<div><b>API Key</b> <%= $client_api_key %></div>
+
+@@ layouts/default.html.ep
+<!DOCTYPE html>
+<html>
+  <head><title><%= title %></title></head>
+  <body><%= content %></body>
+</html>
diff --git a/ses/index.cgi b/ses/index.cgi
index 9e1632586..8abd98e24 100755
--- a/ses/index.cgi
+++ b/ses/index.cgi
@@ -13,14 +13,14 @@ use warnings;
 use lib qw(.. ../lib ../local/lib/perl5);
 
 use Bugzilla ();
+use Bugzilla::Constants qw(ERROR_MODE_DIE);
 use Bugzilla::Logging;
-use Bugzilla::Constants qw( ERROR_MODE_DIE );
-use Bugzilla::Mailer qw( MessageToMTA );
+use Bugzilla::Mailer qw(MessageToMTA);
 use Bugzilla::User ();
-use Bugzilla::Util qw( html_quote remote_ip );
-use JSON::MaybeXS qw( decode_json encode_json );
+use Bugzilla::Util qw(html_quote remote_ip);
+use JSON::MaybeXS qw(decode_json);
 use LWP::UserAgent ();
-use Try::Tiny qw( try catch );
+use Try::Tiny qw(catch try);
 
 Bugzilla->error_mode(ERROR_MODE_DIE);
 try {
@@ -41,21 +41,16 @@ sub main {
 
     elsif ( $message_type eq 'Notification' ) {
         my $notification = decode_json_wrapper( $message->{Message} ) // return;
-
-        my $notification_type = $notification->{notificationType} // '';
-        if ( $notification_type eq '' ) {
-            my $keys = join ', ', keys %$notification;
-            WARN("No notificationType in notification (keys: $keys)");
-        }
-        if ( $notification_type eq 'Bounce' ) {
-            process_bounce($notification);
-        }
-        elsif ( $notification_type eq 'Complaint' ) {
-            process_complaint($notification);
-        }
-        else {
-            WARN("Unsupported notification-type: $notification_type");
-            respond( 200 => 'OK' );
+        unless (
+            # https://docs.aws.amazon.com/ses/latest/DeveloperGuide/event-publishing-retrieving-sns-contents.html
+            handle_notification( $notification, 'eventType' )
+
+            # https://docs.aws.amazon.com/ses/latest/DeveloperGuide/notification-contents.html
+            || handle_notification( $notification, 'notificationType' )
+            )
+        {
+            WARN('Failed to find notification type');
+            respond( 400 => 'Bad Request' );
         }
     }
 
@@ -86,6 +81,27 @@ sub confirm_subscription {
     respond( 200 => 'OK' );
 }
 
+sub handle_notification {
+    my ( $notification, $type_field ) = @_;
+
+    if ( !exists $notification->{$type_field} ) {
+        return 0;
+    }
+    my $type = $notification->{$type_field};
+
+    if ( $type eq 'Bounce' ) {
+        process_bounce($notification);
+    }
+    elsif ( $type eq 'Complaint' ) {
+        process_complaint($notification);
+    }
+    else {
+        WARN("Unsupported notification-type: $type");
+        respond( 200 => 'OK' );
+    }
+    return 1;
+}
+
 sub process_bounce {
     my ($notification) = @_;
     my $type = $notification->{bounce}->{bounceType};
@@ -104,8 +120,7 @@ sub process_bounce {
         # disable each account that is permanently bouncing
         foreach my $recipient ( @{ $notification->{bounce}->{bouncedRecipients} } ) {
             my $address = $recipient->{emailAddress};
-            my $reason
-                = sprintf( '(%s) %s', $recipient->{action} // 'error', $recipient->{diagnosticCode} // 'unknown' );
+            my $reason = sprintf '(%s) %s', $recipient->{action} // 'error', $recipient->{diagnosticCode} // 'unknown';
 
             my $user = Bugzilla::User->new( { name => $address, cache => 1 } );
             if ($user) {
@@ -128,8 +143,7 @@ sub process_bounce {
                     $user->set_disabledtext($disable_text);
                     $user->set_disable_mail(1);
                     $user->update();
-                    Bugzilla->audit(
-                        "permanent bounce for <$address> disabled userid-" . $user->id . ": $reason" );
+                    Bugzilla->audit( "permanent bounce for <$address> disabled userid-" . $user->id . ": $reason" );
                 }
             }
 
diff --git a/template/en/default/bug/choose.html.tmpl b/template/en/default/bug/choose.html.tmpl
index 9009d3873..16a76ff02 100644
--- a/template/en/default/bug/choose.html.tmpl
+++ b/template/en/default/bug/choose.html.tmpl
@@ -24,7 +24,7 @@
    title = "Search by $terms.bug number"
  %]
 
-<form method="get" action="show_bug.cgi">
+<form method="get" action="show_bug.cgi" data-no-csrf>
   <p>
     You may find a single [% terms.bug %] by entering its [% terms.bug %] id here:
     <input name="id" size="6">
diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index cf32548b6..bf1ff5ad3 100644
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -313,6 +313,10 @@
     to the <code>JOB_MAP</code> constant in <code>Bugzilla::JobQueue</code>,
     perhaps by using the 'job_map' hook.
 
+  [% ELSIF error == "jobqueue_status_error" %]
+    An error occurred while checking the job queue status. Try again at a
+    later time.  
+
   [% ELSIF error == "ldap_bind_failed" %]
     Failed to bind to the LDAP server. The error message was:
     <code>[% errstr FILTER html %]</code>
diff --git a/template/en/default/global/header.html.tmpl b/template/en/default/global/header.html.tmpl
index ded28d186..1d304ad04 100644
--- a/template/en/default/global/header.html.tmpl
+++ b/template/en/default/global/header.html.tmpl
@@ -244,7 +244,7 @@
 <header id="header" role="banner">
   <div class="inner">
     <h1 id="header-title" class="title"><a href="./" title="Go to home page">[% terms.Bugzilla %]</a></h1>
-    <form role="search" id="header-search" class="quicksearch" action="buglist.cgi">
+    <form role="search" id="header-search" class="quicksearch" action="buglist.cgi" data-no-csrf>
       <section class="searchbox-outer dropdown" role="combobox" aria-expanded="false" aria-haspopup="listbox"
                aria-owns="header-search-dropdown">
         <h2>Quick Search</h2>
diff --git a/template/en/default/index.html.tmpl b/template/en/default/index.html.tmpl
index 14cdb599a..177025686 100644
--- a/template/en/default/index.html.tmpl
+++ b/template/en/default/index.html.tmpl
@@ -53,7 +53,7 @@
              href="?GoAheadAndLogIn=1"><span>Log In</span></a>
            [% END %]
 
-        <form id="quicksearchForm" name="quicksearchForm" action="buglist.cgi">
+        <form id="quicksearchForm" name="quicksearchForm" action="buglist.cgi" data-no-csrf>
           <div>
             <input id="quicksearch_main" type="text" name="quicksearch" autofocus
               placeholder="Enter [% terms.abug %] number or some search terms"
diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl
index 8edd21aee..d1aada24c 100644
--- a/template/en/default/list/change-columns.html.tmpl
+++ b/template/en/default/list/change-columns.html.tmpl
@@ -51,7 +51,7 @@
   [% available_columns.$column_desc = column %]
 [% END %]
 
-<form name="changecolumns" action="colchange.cgi" onsubmit="change_submit();">
+<form name="changecolumns" action="colchange.cgi" onsubmit="change_submit();" data-no-csrf>
   <input type="hidden" name="rememberedquery" value="[% buffer FILTER html %]">
     <table>
       <tr>
diff --git a/template/en/default/list/list.html.tmpl b/template/en/default/list/list.html.tmpl
index c17512c79..8fcb8a7ac 100644
--- a/template/en/default/list/list.html.tmpl
+++ b/template/en/default/list/list.html.tmpl
@@ -175,14 +175,14 @@
   <tr>
     [% IF bugs.size > 0 %]
       <td valign="middle" class="bz_query_buttons">
-        <form method="post" action="show_bug.cgi">
+        <form method="post" action="show_bug.cgi" data-no-csrf>
           [% FOREACH id = buglist %]
             <input type="hidden" name="id" value="[% id FILTER html %]">
           [% END %]
           <input type="hidden" name="format" value="multiple">
           <input type="submit" id="long_format" value="Long Format">
         </form>
-        <form method="post" action="show_bug.cgi">
+        <form method="post" action="show_bug.cgi" data-no-csrf>
             <input type="hidden" name="ctype" value="xml">
           [% FOREACH id = buglist %]
             <input type="hidden" name="id" value="[% id FILTER html %]">
@@ -192,7 +192,7 @@
         </form>
 
         [% IF user.is_timetracker %]
-          <form method="post" action="summarize_time.cgi">
+          <form method="post" action="summarize_time.cgi" data-no-csrf>
             <input type="hidden" name="id" value="[% buglist_joined FILTER html %]">
             <input type="submit" id="timesummary" value="Time Summary">
           </form>
diff --git a/template/en/default/pages/quicksearch.html.tmpl b/template/en/default/pages/quicksearch.html.tmpl
index 759f4ea8c..28062b535 100644
--- a/template/en/default/pages/quicksearch.html.tmpl
+++ b/template/en/default/pages/quicksearch.html.tmpl
@@ -31,7 +31,7 @@
 <p>Type in one or more words (or pieces of words) to search for:</p>
 
 <form name="f" action="buglist.cgi" method="get"
-      class='quicksearch_check_empty'>
+      class='quicksearch_check_empty' data-no-csrf>
   <input type="text" size="40" name="quicksearch">
   <input type="submit" value="Search" id="find">
 </form>
diff --git a/template/en/default/reports/duplicates.html.tmpl b/template/en/default/reports/duplicates.html.tmpl
index ff1c271fe..ed3e7b8ac 100644
--- a/template/en/default/reports/duplicates.html.tmpl
+++ b/template/en/default/reports/duplicates.html.tmpl
@@ -60,7 +60,7 @@
 
 <h3 id="params">Change Parameters</h3>
 
-<form method="get" action="duplicates.cgi">
+<form method="get" action="duplicates.cgi" data-no-csrf>
   <input type="hidden" name="sortby" value="[% sortby FILTER html %]">
   <input type="hidden" name="reverse" value="[% reverse FILTER html %]">
   <input type="hidden" name="bug_id" value="[% bug_ids_string FILTER html %]">
@@ -127,7 +127,7 @@
   <input type="submit" id="change" value="Change">
 </form>
 
-<form method="post" action="buglist.cgi">
+<form method="post" action="buglist.cgi" data-no-csrf>
   <input type="hidden" name="bug_id" value="[% bug_ids_string FILTER html %]">
   Or just give this to me as a <input type="submit" id="list" 
                                       value="[% terms.bug %] list">.
diff --git a/template/en/default/reports/old-charts.html.tmpl b/template/en/default/reports/old-charts.html.tmpl
index 4bdc0cffa..38e17121b 100644
--- a/template/en/default/reports/old-charts.html.tmpl
+++ b/template/en/default/reports/old-charts.html.tmpl
@@ -32,7 +32,7 @@
     <img src="[% url_image FILTER html %]">
     <br clear="both">
   [% ELSE %]
-    <form id="choose_product" method="get" action="reports.cgi">
+    <form id="choose_product" method="get" action="reports.cgi" data-no-csrf>
       <table border="1" cellpadding="5" cellspacing="2">
         <tr>
           <th>Product:</th>
diff --git a/template/en/default/search/search-advanced.html.tmpl b/template/en/default/search/search-advanced.html.tmpl
index 60f47a916..b51906774 100644
--- a/template/en/default/search/search-advanced.html.tmpl
+++ b/template/en/default/search/search-advanced.html.tmpl
@@ -60,7 +60,7 @@ function remove_token() {
 <p id="search_help">Hover your mouse over each field label to get help for that field.</p>
 
 <form method="post" action="buglist.cgi" name="queryform" id="queryform"
-      onsubmit="remove_token()">
+      onsubmit="remove_token()" data-no-csrf>
 
 [% PROCESS search/form.html.tmpl %]
 
diff --git a/template/en/default/search/search-google.html.tmpl b/template/en/default/search/search-google.html.tmpl
index ad45cce94..7fdc1daaa 100644
--- a/template/en/default/search/search-google.html.tmpl
+++ b/template/en/default/search/search-google.html.tmpl
@@ -31,7 +31,7 @@
   Google only indexes publicly viewable [% terms.bugs %] and all may not be represented.
 <p>
 
-<form method="get" action="https://www.google.com/search">
+<form method="get" action="https://www.google.com/search" data-no-csrf>
 <input type="hidden" name="sitesearch" value="bugzilla.mozilla.org">
   <nobr>
     <input type="text" name="q" size="60" maxlength="255" value="">
diff --git a/template/en/default/search/search-specific.html.tmpl b/template/en/default/search/search-specific.html.tmpl
index 3b4cc3514..be314101f 100644
--- a/template/en/default/search/search-specific.html.tmpl
+++ b/template/en/default/search/search-specific.html.tmpl
@@ -39,7 +39,7 @@ For example, if the [% terms.bug %] you are looking for is a browser crash when
 for "crash secure SSL flash".
 </p>
 
-<form name="queryform" method="get" action="buglist.cgi">
+<form name="queryform" method="get" action="buglist.cgi" data-no-csrf>
 <input type="hidden" name="query_format" value="specific">
 <input type="hidden" name="order" value="relevance desc">
 
diff --git a/vagrant_support/apache.j2 b/vagrant_support/apache.j2
index 722ebad92..773672fa1 100644
--- a/vagrant_support/apache.j2
+++ b/vagrant_support/apache.j2
@@ -1,5 +1,6 @@
 PerlSwitches -wT
 PerlSetEnv USE_NYTPROF 0
+PerlSetEnv BUGZILLA_UNSAFE_AUTH_DELEGATION 1
 PerlConfigRequire /vagrant/mod_perl.pl
 
 <IfModule mpm_prefork_module>