diff options
27 files changed, 489 insertions, 251 deletions
diff --git a/Bugzilla/Config/Advanced.pm b/Bugzilla/Config/Advanced.pm index b70dcb9e3..a5ae3048a 100644 --- a/Bugzilla/Config/Advanced.pm +++ b/Bugzilla/Config/Advanced.pm @@ -46,7 +46,8 @@ use constant get_param_list => ( { name => 'inbound_proxies', type => 't', - default => '' + default => '', + checker => \&check_ip }, { diff --git a/Bugzilla/Config/Common.pm b/Bugzilla/Config/Common.pm index 9fffe02ee..00c699217 100644 --- a/Bugzilla/Config/Common.pm +++ b/Bugzilla/Config/Common.pm @@ -48,7 +48,7 @@ use base qw(Exporter); qw(check_multi check_numeric check_regexp check_url check_group check_sslbase check_priority check_severity check_platform check_opsys check_shadowdb check_urlbase check_webdotbase - check_user_verify_class + check_user_verify_class check_ip check_mail_delivery_method check_notification check_utf8 check_bug_status check_smtp_auth check_theschwartz_available check_maxattachmentsize check_email @@ -129,6 +129,15 @@ sub check_sslbase { return ""; } +sub check_ip { + my $inbound_proxies = shift; + my @proxies = split(/[\s,]+/, $inbound_proxies); + foreach my $proxy (@proxies) { + validate_ip($proxy) || return "$proxy is not a valid IPv4 or IPv6 address"; + } + return ""; +} + sub check_utf8 { my $utf8 = shift; # You cannot turn off the UTF-8 parameter if you've already converted diff --git a/Bugzilla/Constants.pm b/Bugzilla/Constants.pm index 3d3d4a41d..78336818f 100644 --- a/Bugzilla/Constants.pm +++ b/Bugzilla/Constants.pm @@ -202,7 +202,7 @@ use Memoize; # CONSTANTS # # Bugzilla version -use constant BUGZILLA_VERSION => "4.2+"; +use constant BUGZILLA_VERSION => "4.2.1"; # Location of the remote and local XML files to track new releases. use constant REMOTE_FILE => 'http://updates.bugzilla.org/bugzilla-update.xml'; diff --git a/Bugzilla/DB/Schema.pm b/Bugzilla/DB/Schema.pm index 874a99ce0..00ff4acc9 100644 --- a/Bugzilla/DB/Schema.pm +++ b/Bugzilla/DB/Schema.pm @@ -2938,7 +2938,7 @@ unsigned) =item C<SMALLSERIAL> -An auto-increment L</INT1> +An auto-increment L</INT2> =item C<MEDIUMSERIAL> diff --git a/Bugzilla/Error.pm b/Bugzilla/Error.pm index df03dfd6d..2114bba47 100644 --- a/Bugzilla/Error.pm +++ b/Bugzilla/Error.pm @@ -93,6 +93,8 @@ sub _throw_error { } my $template = Bugzilla->template; + my $message; + if (Bugzilla->error_mode == ERROR_MODE_WEBPAGE) { if (arecibo_should_notify($vars->{error})) { $vars->{maintainers_notified} = 1; @@ -111,52 +113,62 @@ sub _throw_error { $vars->{error}, $vars->{processed}->{error_message}, $vars->{uid}); } } + # There are some tests that throw and catch a lot of errors, # and calling $template->process over and over for those errors # is too slow. So instead, we just "die" with a dump of the arguments. + if (Bugzilla->error_mode != ERROR_MODE_TEST) { + $template->process($name, $vars, \$message) + || ThrowTemplateError($template->error()); + } + + # Let's call the hook first, so that extensions can override + # or extend the default behavior, or add their own error codes. + require Bugzilla::Hook; + Bugzilla::Hook::process('error_catch', { error => $error, vars => $vars, + message => \$message }); + + if (Bugzilla->error_mode == ERROR_MODE_WEBPAGE) { + print Bugzilla->cgi->header(); + print $message; + } elsif (Bugzilla->error_mode == ERROR_MODE_TEST) { die Dumper($vars); } - else { - my $message; - $template->process($name, $vars, \$message) - || ThrowTemplateError($template->error()); - if (Bugzilla->error_mode == ERROR_MODE_DIE) { - die("$message\n"); + elsif (Bugzilla->error_mode == ERROR_MODE_DIE) { + die("$message\n"); + } + elsif (Bugzilla->error_mode == ERROR_MODE_DIE_SOAP_FAULT + || Bugzilla->error_mode == ERROR_MODE_JSON_RPC) + { + # Clone the hash so we aren't modifying the constant. + my %error_map = %{ WS_ERROR_CODE() }; + Bugzilla::Hook::process('webservice_error_codes', + { error_map => \%error_map }); + my $code = $error_map{$error}; + if (!$code) { + $code = ERROR_UNKNOWN_FATAL if $name =~ /code/i; + $code = ERROR_UNKNOWN_TRANSIENT if $name =~ /user/i; } - elsif (Bugzilla->error_mode == ERROR_MODE_DIE_SOAP_FAULT - || Bugzilla->error_mode == ERROR_MODE_JSON_RPC) - { - # Clone the hash so we aren't modifying the constant. - my %error_map = %{ WS_ERROR_CODE() }; - require Bugzilla::Hook; - Bugzilla::Hook::process('webservice_error_codes', - { error_map => \%error_map }); - my $code = $error_map{$error}; - if (!$code) { - $code = ERROR_UNKNOWN_FATAL if $name =~ /code/i; - $code = ERROR_UNKNOWN_TRANSIENT if $name =~ /user/i; - } - - if (Bugzilla->error_mode == ERROR_MODE_DIE_SOAP_FAULT) { - die SOAP::Fault->faultcode($code)->faultstring($message); - } - else { - my $server = Bugzilla->_json_server; - # Technically JSON-RPC isn't allowed to have error numbers - # higher than 999, but we do this to avoid conflicts with - # the internal JSON::RPC error codes. - $server->raise_error(code => 100000 + $code, - message => $message, - id => $server->{_bz_request_id}, - version => $server->version); - # Most JSON-RPC Throw*Error calls happen within an eval inside - # of JSON::RPC. So, in that circumstance, instead of exiting, - # we die with no message. JSON::RPC checks raise_error before - # it checks $@, so it returns the proper error. - die if _in_eval(); - $server->response($server->error_response_header); - } + + if (Bugzilla->error_mode == ERROR_MODE_DIE_SOAP_FAULT) { + die SOAP::Fault->faultcode($code)->faultstring($message); + } + else { + my $server = Bugzilla->_json_server; + # Technically JSON-RPC isn't allowed to have error numbers + # higher than 999, but we do this to avoid conflicts with + # the internal JSON::RPC error codes. + $server->raise_error(code => 100000 + $code, + message => $message, + id => $server->{_bz_request_id}, + version => $server->version); + # Most JSON-RPC Throw*Error calls happen within an eval inside + # of JSON::RPC. So, in that circumstance, instead of exiting, + # we die with no message. JSON::RPC checks raise_error before + # it checks $@, so it returns the proper error. + die if _in_eval(); + $server->response($server->error_response_header); } } exit; diff --git a/Bugzilla/Hook.pm b/Bugzilla/Hook.pm index 564c5bc49..da17946c0 100644 --- a/Bugzilla/Hook.pm +++ b/Bugzilla/Hook.pm @@ -127,6 +127,30 @@ This describes what hooks exist in Bugzilla currently. They are mostly in alphabetical order, but some related hooks are near each other instead of being alphabetical. +=head2 admin_editusers_action + +This hook allows you to add additional actions to the admin Users page. + +Params: + +=over + +=item C<vars> + +You can add as many new key/value pairs as you want to this hashref. +It will be passed to the template. + +=item C<action> + +A text which indicates the different behaviors that editusers.cgi will have. +With this hook you can change the behavior of an action or add new actions. + +=item C<user> + +This is a Bugzilla::User object of the user. + +=back + =head2 attachment_process_data This happens at the very beginning process of the attachment creation. @@ -432,6 +456,41 @@ The definition is structured as: =back +=head2 buglist_column_joins + +This allows you to join additional tables to display additional columns +in buglists. This hook is generally used in combination with the +C<buglist_columns> hook. + +Params: + +=over + +=item C<column_joins> - A hashref containing data to return back to +L<Bugzilla::Search>. This hashref contains names of the columns as keys and +a hashref about table to join as values. This hashref has the following keys: + +=over + +=item C<table> - The name of the additional table to join. + +=item C<as> - (optional) The alias used for the additional table. This alias +must not conflict with an existing alias already used in the query. + +=item C<from> - (optional) The name of the column in the C<bugs> table which +the additional table should be linked to. If omitted, C<bug_id> will be used. + +=item C<to> - (optional) The name of the column in the additional table which +should be linked to the column in the C<bugs> table, see C<from> above. +If omitted, C<bug_id> will be used. + +=item C<join> - (optional) Either INNER or LEFT. Determine how the additional +table should be joined with the C<bugs> table. If omitted, LEFT is used. + +=back + +=back + =head2 search_operator_field_override This allows you to modify L<Bugzilla::Search/OPERATOR_FIELD_OVERRIDE>, @@ -628,6 +687,37 @@ Params: =back +=head2 error_catch + +This hook allows extensions to catch errors thrown by Bugzilla and +take the appropriate actions. + +Params: + +=over + +=item C<error> + +A string representing the error code thrown by Bugzilla. This string +matches the C<error> variable in C<global/user-error.html.tmpl> and +C<global/code-error.html.tmpl>. + +=item C<message> + +If the error mode is set to C<ERROR_MODE_WEBPAGE>, you get a reference to +the whole HTML page with the error message in it, including its header and +footer. If you need to extract the error message itself, you can do it by +looking at the content of the table cell whose ID is C<error_msg>. +If the error mode is not set to C<ERROR_MODE_WEBPAGE>, you get a reference +to the error message itself. + +=item C<vars> + +This hash contains all the data passed to the error template. Its content +depends on the error thrown. + +=back + =head2 flag_end_of_update This happens at the end of L<Bugzilla::Flag/update_flags>, after all other @@ -1354,30 +1444,6 @@ name), you can get it from here. =back -=head2 admin_editusers_action - -This hook allows you to add additional actions to the admin Users page. - -Params: - -=over - -=item C<vars> - -You can add as many new key/value pairs as you want to this hashref. -It will be passed to the template. - -=item C<action> - -A text which indicates the different behaviors that edit_users.cgi will have. -With this hook you can change the behavior of an action or add new actions. - -=item C<user> - -This is a Bugzilla::User object of the user. - -=back - =head2 user_preferences This hook allows you to add additional panels to the User Preferences page, diff --git a/Bugzilla/Search.pm b/Bugzilla/Search.pm index 7d2d63284..c0a58c3f0 100644 --- a/Bugzilla/Search.pm +++ b/Bugzilla/Search.pm @@ -792,8 +792,8 @@ sub _param_array { } sub _params { $_[0]->{params} } - sub _user { return $_[0]->{user} } +sub _sharer_id { $_[0]->{sharer} } ############################## # Internal Accessors: SELECT # @@ -959,7 +959,8 @@ sub _column_join { my ($self, $field) = @_; # The _realname fields require the same join as the username fields. $field =~ s/_realname$//; - my $join_info = COLUMN_JOINS->{$field}; + my $column_joins = $self->_get_column_joins(); + my $join_info = $column_joins->{$field}; if ($join_info) { # Don't allow callers to modify the constant. $join_info = dclone($join_info); @@ -1800,6 +1801,20 @@ sub _get_operator_field_override { return $cache->{operator_field_override}; } +sub _get_column_joins { + my $self = shift; + my $cache = Bugzilla->request_cache; + + return $cache->{column_joins} if defined $cache->{column_joins}; + + my %column_joins = %{ COLUMN_JOINS() }; + Bugzilla::Hook::process('buglist_column_joins', + { column_joins => \%column_joins }); + + $cache->{column_joins} = \%column_joins; + return $cache->{column_joins}; +} + ########################### # Search Function Helpers # ########################### @@ -1912,16 +1927,22 @@ sub _timestamp_translate { my $value = $args->{value}; my $dbh = Bugzilla->dbh; - return if $value !~ /^[\+\-]?\d+[hdwmy]s?$/i; - - $args->{value} = SqlifyDate($value); - $args->{quoted} = $dbh->quote($args->{value}); + return if $value !~ /^(?:[\+\-]?\d+[hdwmy]s?|now)$/i; + + # By default, the time is appended to the date, which we don't want + # for deadlines. + $value = SqlifyDate($value); + if ($args->{field} eq 'deadline') { + ($value) = split(/\s/, $value); + } + $args->{value} = $value; + $args->{quoted} = $dbh->quote($value); } sub SqlifyDate { my ($str) = @_; my $fmt = "%Y-%m-%d %H:%M:%S"; - $str = "" if !defined $str; + $str = "" if (!defined $str || lc($str) eq 'now'); if ($str eq "") { my ($sec, $min, $hour, $mday, $month, $year, $wday) = localtime(time()); return sprintf("%4d-%02d-%02d 00:00:00", $year+1900, $month+1, $mday); @@ -2549,8 +2570,8 @@ sub _multiselect_table { } elsif ($field eq 'tag') { $args->{full_field} = 'tag.name'; - return "bug_tag INNER JOIN tag ON bug_tag.tag_id = tag.id" - . " AND user_id = " . $self->_user->id; + return "bug_tag INNER JOIN tag ON bug_tag.tag_id = tag.id AND user_id = " + . ($self->_sharer_id || $self->_user->id); } elsif ($field eq 'bug_group') { $args->{full_field} = 'groups.name'; diff --git a/Bugzilla/Search/Quicksearch.pm b/Bugzilla/Search/Quicksearch.pm index 563d2387c..54592f07e 100644 --- a/Bugzilla/Search/Quicksearch.pm +++ b/Bugzilla/Search/Quicksearch.pm @@ -129,7 +129,7 @@ use constant COMPONENT_EXCEPTIONS => ( ); # Quicksearch-wide globals for boolean charts. -our ($chart, $and, $or, $fulltext); +our ($chart, $and, $or, $fulltext, $bug_status_set); sub quicksearch { my ($searchstring) = (@_); @@ -199,7 +199,8 @@ sub quicksearch { } } - _handle_status_and_resolution(\@qswords); + _handle_status_and_resolution($qswords[0]); + shift(@qswords) if $bug_status_set; my (@unknownFields, %ambiguous_fields); $fulltext = Bugzilla->user->setting('quicksearch_fulltext') eq 'on' ? 1 : 0; @@ -233,6 +234,12 @@ sub quicksearch { $or = 0; } + # If there is no mention of a bug status, we restrict the query + # to open bugs by default. + unless ($bug_status_set) { + $cgi->param('bug_status', BUG_STATE_OPEN); + } + # Inform user about any unknown fields if (scalar(@unknownFields) || scalar(keys %ambiguous_fields)) { ThrowUserError("quicksearch_unknown_field", @@ -303,48 +310,26 @@ sub _handle_alias { } sub _handle_status_and_resolution { - my ($words) = @_; + my $word = shift; my $legal_statuses = get_legal_field_values('bug_status'); - my $legal_resolutions = get_legal_field_values('resolution'); - - my @openStates = BUG_STATE_OPEN; - my @closedStates; my (%states, %resolutions); + $bug_status_set = 1; - foreach (@$legal_statuses) { - push(@closedStates, $_) unless is_open_state($_); - } - foreach (@openStates) { $states{$_} = 1 } - if ($words->[0] eq 'ALL') { - foreach (@$legal_statuses) { $states{$_} = 1 } - shift @$words; + if ($word eq 'OPEN') { + $states{$_} = 1 foreach BUG_STATE_OPEN; } - elsif ($words->[0] eq 'OPEN') { - shift @$words; - } - elsif ($words->[0] =~ /^[A-Z_]+(,[_A-Z]+)*$/) { - # e.g. CON,IN_PR,FIX - undef %states; - if (matchPrefixes(\%states, - \%resolutions, - [split(/,/, $words->[0])], - $legal_statuses, - $legal_resolutions)) { - shift @$words; - } - else { - # Carry on if no match found - foreach (@openStates) { $states{$_} = 1 } - } - } - else { - # Default: search for unresolved bugs only. - # Put custom code here if you would like to change this behaviour. + # If we want all bugs, then there is nothing to do. + elsif ($word ne 'ALL' + && !matchPrefixes(\%states, \%resolutions, $word, $legal_statuses)) + { + $bug_status_set = 0; } # If we have wanted resolutions, allow closed states if (keys(%resolutions)) { - foreach (@closedStates) { $states{$_} = 1 } + foreach my $status (@$legal_statuses) { + $states{$status} = 1 unless is_open_state($status); + } } Bugzilla->cgi->param('bug_status', keys(%states)); @@ -416,6 +401,9 @@ sub _handle_field_names { $ambiguous_fields->{$field} = $translated; } else { + if ($translated eq 'bug_status' || $translated eq 'resolution') { + $bug_status_set = 1; + } foreach my $value (@values) { my $operator = FIELD_OPERATOR->{$translated} || 'substring'; # If the string was quoted to protect some special @@ -575,14 +563,14 @@ sub _matches_phrase { # Expand found prefixes to states or resolutions sub matchPrefixes { - my $hr_states = shift; - my $hr_resolutions = shift; - my $ar_prefixes = shift; - my $ar_check_states = shift; - my $ar_check_resolutions = shift; + my ($hr_states, $hr_resolutions, $word, $ar_check_states) = @_; + return unless $word =~ /^[A-Z_]+(,[A-Z_]+)*$/; + + my @ar_prefixes = split(/,/, $word); + my $ar_check_resolutions = get_legal_field_values('resolution'); my $foundMatch = 0; - foreach my $prefix (@$ar_prefixes) { + foreach my $prefix (@ar_prefixes) { foreach (@$ar_check_states) { if (/^$prefix/) { $$hr_states{$_} = 1; diff --git a/Bugzilla/Util.pm b/Bugzilla/Util.pm index 7ecaddc88..c2dbdc97d 100644 --- a/Bugzilla/Util.pm +++ b/Bugzilla/Util.pm @@ -35,7 +35,7 @@ use base qw(Exporter); detaint_signed html_quote url_quote xml_quote css_class_quote html_light_quote - i_am_cgi correct_urlbase remote_ip + i_am_cgi correct_urlbase remote_ip validate_ip do_ssl_redirect_if_required use_attachbase diff_arrays on_main_db trim wrap_hard wrap_comment find_wrap_point @@ -285,12 +285,103 @@ sub correct_urlbase { sub remote_ip { my $ip = $ENV{'REMOTE_ADDR'} || '127.0.0.1'; my @proxies = split(/[\s,]+/, Bugzilla->params->{'inbound_proxies'}); - if (first { $_ eq $ip } @proxies) { - $ip = $ENV{'HTTP_X_FORWARDED_FOR'} if $ENV{'HTTP_X_FORWARDED_FOR'}; + + # If the IP address is one of our trusted proxies, then we look at + # the X-Forwarded-For header to determine the real remote IP address. + if ($ENV{'HTTP_X_FORWARDED_FOR'} && first { $_ eq $ip } @proxies) { + my @ips = split(/[\s,]+/, $ENV{'HTTP_X_FORWARDED_FOR'}); + # This header can contain several IP addresses. We want the + # IP address of the machine which connected to our proxies as + # all other IP addresses may be fake or internal ones. + # Note that this may block a whole external proxy, but we have + # no way to determine if this proxy is malicious or trustable. + foreach my $remote_ip (reverse @ips) { + if (!first { $_ eq $remote_ip } @proxies) { + # Keep the original IP address if the remote IP is invalid. + $ip = validate_ip($remote_ip) || $ip; + last; + } + } } return $ip; } +sub validate_ip { + my $ip = shift; + return is_ipv4($ip) || is_ipv6($ip); +} + +# Copied from Data::Validate::IP::is_ipv4(). +sub is_ipv4 { + my $ip = shift; + return unless defined $ip; + + my @octets = $ip =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/; + return unless scalar(@octets) == 4; + + foreach my $octet (@octets) { + return unless ($octet >= 0 && $octet <= 255 && $octet !~ /^0\d{1,2}$/); + } + + # The IP address is valid and can now be detainted. + return join('.', @octets); +} + +# Copied from Data::Validate::IP::is_ipv6(). +sub is_ipv6 { + my $ip = shift; + return unless defined $ip; + + # If there is a :: then there must be only one :: and the length + # can be variable. Without it, the length must be 8 groups. + my @chunks = split(':', $ip); + + # Need to check if the last chunk is an IPv4 address, if it is we + # pop it off and exempt it from the normal IPv6 checking and stick + # it back on at the end. If there is only one chunk and it's an IPv4 + # address, then it isn't an IPv6 address. + my $ipv4; + my $expected_chunks = 8; + if (@chunks > 1 && is_ipv4($chunks[$#chunks])) { + $ipv4 = pop(@chunks); + $expected_chunks--; + } + + my $empty = 0; + # Workaround to handle trailing :: being valid. + if ($ip =~ /[0-9a-f]{1,4}::$/) { + $empty++; + # Single trailing ':' is invalid. + } elsif ($ip =~ /:$/) { + return; + } + + foreach my $chunk (@chunks) { + return unless $chunk =~ /^[0-9a-f]{0,4}$/i; + $empty++ if $chunk eq ''; + } + # More than one :: block is bad, but if it starts with :: it will + # look like two, so we need an exception. + if ($empty == 2 && $ip =~ /^::/) { + # This is ok + } elsif ($empty > 1) { + return; + } + + push(@chunks, $ipv4) if $ipv4; + # Need 8 chunks, or we need an empty section that could be filled + # to represent the missing '0' sections. + return unless (@chunks == $expected_chunks || @chunks < $expected_chunks && $empty); + + my $ipv6 = join(':', @chunks); + # The IP address is valid and can now be detainted. + trick_taint($ipv6); + + # Need to handle the exception of trailing :: being valid. + return "${ipv6}::" if $ip =~ /::$/; + return $ipv6; +} + sub use_attachbase { my $attachbase = Bugzilla->params->{'attachment_base'}; return ($attachbase ne '' @@ -884,6 +975,17 @@ in a command-line script. Returns either the C<sslbase> or C<urlbase> parameter, depending on the current setting for the C<ssl_redirect> parameter. +=item C<remote_ip()> + +Returns the IP address of the remote client. If Bugzilla is behind +a trusted proxy, it will get the remote IP address by looking at the +X-Forwarded-For header. + +=item C<validate_ip($ip)> + +Returns the sanitized IP address if it is a valid IPv4 or IPv6 address, +else returns undef. + =item C<use_attachbase()> Returns true if an alternate host is used to display attachments; false diff --git a/buglist.cgi b/buglist.cgi index d2f9a6904..6236a5669 100755 --- a/buglist.cgi +++ b/buglist.cgi @@ -113,16 +113,6 @@ if (defined $cgi->param('ctype') && $cgi->param('ctype') eq "rss") { $cgi->param('ctype', "atom"); } -# The js ctype presents a security risk; a malicious site could use it -# to gather information about secure bugs. So, we only allow public bugs to be -# retrieved with this format. -# -# Note that if and when this call clears cookies or has other persistent -# effects, we'll need to do this another way instead. -if ((defined $cgi->param('ctype')) && ($cgi->param('ctype') eq "js")) { - Bugzilla->logout_request(); -} - # An agent is a program that automatically downloads and extracts data # on its user's behalf. If this request comes from an agent, we turn off # various aspects of bug list functionality so agent requests succeed @@ -229,7 +219,9 @@ sub LookupNamedQuery { $query->url || ThrowUserError("buglist_parameters_required"); - return wantarray ? ($query->url, $query->id) : $query->url; + # Detaint $sharer_id. + $sharer_id = $query->user->id if $sharer_id; + return wantarray ? ($query->url, $query->id, $sharer_id) : $query->url; } # Inserts a Named Query (a "Saved Search") into the database, or @@ -348,6 +340,7 @@ sub _close_standby_message { my $cmdtype = $cgi->param('cmdtype') || ''; my $remaction = $cgi->param('remaction') || ''; +my $sharer_id; # Backwards-compatibility - the old interface had cmdtype="runnamed" to run # a named command, and we can't break this because it's in bookmarks. @@ -384,8 +377,9 @@ $filename =~ s/"/\\"/g; # escape quotes if ($cmdtype eq "dorem") { if ($remaction eq "run") { my $query_id; - ($buffer, $query_id) = LookupNamedQuery(scalar $cgi->param("namedcmd"), - scalar $cgi->param('sharer_id')); + ($buffer, $query_id, $sharer_id) = + LookupNamedQuery(scalar $cgi->param("namedcmd"), + scalar $cgi->param('sharer_id')); # If this is the user's own query, remember information about it # so that it can be modified easily. $vars->{'searchname'} = $cgi->param('namedcmd'); @@ -775,7 +769,8 @@ if ($format->{'extension'} eq 'html' && !defined $params->param('limit')) { # Generate the basic SQL query that will be used to generate the bug list. my $search = new Bugzilla::Search('fields' => \@selectcolumns, 'params' => scalar $params->Vars, - 'order' => \@orderstrings); + 'order' => \@orderstrings, + 'sharer' => $sharer_id); my $query = $search->sql; $vars->{'search_description'} = $search->search_description; diff --git a/docs/en/xml/Bugzilla-Guide.xml b/docs/en/xml/Bugzilla-Guide.xml index db33e8d57..bfb1146d9 100644 --- a/docs/en/xml/Bugzilla-Guide.xml +++ b/docs/en/xml/Bugzilla-Guide.xml @@ -32,9 +32,9 @@ For a devel release, simple bump bz-ver and bz-date --> -<!ENTITY bz-ver "4.2"> +<!ENTITY bz-ver "4.2.1"> <!ENTITY bz-nextver "4.4"> -<!ENTITY bz-date "2012-02-22"> +<!ENTITY bz-date "2012-04-18"> <!ENTITY current-year "2012"> <!ENTITY landfillbase "http://landfill.bugzilla.org/bugzilla-4.2-branch/"> diff --git a/docs/en/xml/using.xml b/docs/en/xml/using.xml index 6d575c0c1..3bf0558fc 100644 --- a/docs/en/xml/using.xml +++ b/docs/en/xml/using.xml @@ -659,16 +659,6 @@ </member> </simplelist> </para> - - <para> - If you would like to access the bug list from another program - it is often useful to have the list returned in something other - than HTML. By adding the ctype=type parameter into the bug list URL - you can specify several alternate formats. Besides the types described - above, the following formats are also supported: ECMAScript, also known - as JavaScript (ctype=js), and Resource Description Framework RDF/XML - (ctype=rdf). - </para> </section> <section id="individual-buglists"> diff --git a/extensions/Example/Extension.pm b/extensions/Example/Extension.pm index af56b506b..885a8e8ff 100644 --- a/extensions/Example/Extension.pm +++ b/extensions/Example/Extension.pm @@ -196,6 +196,22 @@ sub buglist_columns { my $columns = $args->{'columns'}; $columns->{'example'} = { 'name' => 'bugs.delta_ts' , 'title' => 'Example' }; + $columns->{'product_desc'} = { 'name' => 'prod_desc.description', + 'title' => 'Product Description' }; +} + +sub buglist_column_joins { + my ($self, $args) = @_; + my $joins = $args->{'column_joins'}; + + # This column is added using the "buglist_columns" hook + $joins->{'product_desc'} = { + from => 'product_id', + to => 'id', + table => 'products', + as => 'prod_desc', + join => 'INNER', + }; } sub search_operator_field_override { @@ -339,6 +355,25 @@ sub enter_bug_entrydefaultvars { $vars->{'example'} = 1; } +sub error_catch { + my ($self, $args) = @_; + # Customize the error message displayed when someone tries to access + # page.cgi with an invalid page ID, and keep track of this attempt + # in the web server log. + return unless Bugzilla->error_mode == ERROR_MODE_WEBPAGE; + return unless $args->{error} eq 'bad_page_cgi_id'; + + my $page_id = $args->{vars}->{page_id}; + my $login = Bugzilla->user->identity || "Someone"; + warn "$login attempted to access page.cgi with id = $page_id"; + + my $page = $args->{message}; + my $new_error_msg = "Ah ah, you tried to access $page_id? Good try!"; + $new_error_msg = html_quote($new_error_msg); + # There are better tools to parse an HTML page, but it's just an example. + $$page =~ s/(?<=<td id="error_msg" class="throw_error">).*(?=<\/td>)/$new_error_msg/si; +} + sub flag_end_of_update { my ($self, $args) = @_; diff --git a/extensions/Voting/Extension.pm b/extensions/Voting/Extension.pm index 26fb58fa3..3fb799bbf 100644 --- a/extensions/Voting/Extension.pm +++ b/extensions/Voting/Extension.pm @@ -499,7 +499,10 @@ sub _page_user { } } - $dbh->do('DELETE FROM votes WHERE vote_count <= 0'); + if ($canedit && $bug) { + $dbh->do('DELETE FROM votes WHERE vote_count = 0 AND who = ?', + undef, $who->id); + } $dbh->bz_commit_transaction(); $vars->{'canedit'} = $canedit; diff --git a/js/comments.js b/js/comments.js index 28ef54397..e9a3e209f 100644 --- a/js/comments.js +++ b/js/comments.js @@ -67,13 +67,11 @@ function toggle_all_comments(action) { function collapse_comment(link, comment) { link.innerHTML = "[+]"; - link.title = "Expand the comment."; YAHOO.util.Dom.addClass(comment, 'collapsed'); } function expand_comment(link, comment) { link.innerHTML = "[-]"; - link.title = "Collapse the comment"; YAHOO.util.Dom.removeClass(comment, 'collapsed'); } @@ -127,11 +125,11 @@ function wrapReplyText(text) { /* This way, we are sure that browsers which do not support JS * won't display this link */ -function addCollapseLink(count) { +function addCollapseLink(count, title) { document.write(' <a href="#" class="bz_collapse_comment"' + ' id="comment_link_' + count + '" onclick="toggle_comment_display(this, ' + count + - '); return false;" title="Collapse the comment.">[-]<\/a> '); + '); return false;" title="' + title + '">[-]<\/a> '); } function goto_add_comments( anchor ){ diff --git a/js/field.js b/js/field.js index 8353100f0..e3fe460cf 100644 --- a/js/field.js +++ b/js/field.js @@ -218,12 +218,12 @@ function setupEditLink(id) { hideEditableField(link_container, input_container, link); } -/* Hide input fields and show the text with (edit) next to it */ +/* Hide input/select fields and show the text with (edit) next to it */ function hideEditableField( container, input, action, field_id, original_value, new_value ) { YAHOO.util.Dom.removeClass(container, 'bz_default_hidden'); YAHOO.util.Dom.addClass(input, 'bz_default_hidden'); YAHOO.util.Event.addListener(action, 'click', showEditableField, - new Array(container, input, new_value)); + new Array(container, input, field_id, new_value)); if(field_id != ""){ YAHOO.util.Event.addListener(window, 'load', checkForChangedFieldValues, new Array(container, input, field_id, original_value)); @@ -231,13 +231,14 @@ function hideEditableField( container, input, action, field_id, original_value, } /* showEditableField (e, ContainerInputArray) - * Function hides the (edit) link and the text and displays the input + * Function hides the (edit) link and the text and displays the input/select field * * var e: the event * var ContainerInputArray: An array containing the (edit) and text area and the input being displayed * var ContainerInputArray[0]: the container that will be hidden usually shows the (edit) or (take) text * var ContainerInputArray[1]: the input area and label that will be displayed - * var ContainerInputArray[2]: the new value to set the input field to when (take) is clicked + * var ContainerInputArray[2]: the input/select field id for which the new value must be set + * var ContainerInputArray[3]: the new value to set the input/select field to when (take) is clicked */ function showEditableField (e, ContainerInputArray) { var inputs = new Array(); @@ -250,6 +251,8 @@ function showEditableField (e, ContainerInputArray) { YAHOO.util.Dom.removeClass(inputArea, 'bz_default_hidden'); if ( inputArea.tagName.toLowerCase() == "input" ) { inputs.push(inputArea); + } else if (ContainerInputArray[2]) { + inputs.push(document.getElementById(ContainerInputArray[2])); } else { inputs = inputArea.getElementsByTagName('input'); if ( inputs.length == 0 ) @@ -258,12 +261,24 @@ function showEditableField (e, ContainerInputArray) { if ( inputs.length > 0 ) { // Change the first field's value to ContainerInputArray[2] // if present before focusing. - if (ContainerInputArray[2]) { - inputs[0].value = ContainerInputArray[2]; + var type = inputs[0].tagName.toLowerCase(); + if (ContainerInputArray[3]) { + if ( type == "input" ) { + inputs[0].value = ContainerInputArray[3]; + } else { + for (var i = 0; inputs[0].length; i++) { + if ( inputs[0].options[i].value == ContainerInputArray[3] ) { + inputs[0].options[i].selected = true; + break; + } + } + } } // focus on the first field, this makes it easier to edit inputs[0].focus(); - inputs[0].select(); + if ( type == "input" ) { + inputs[0].select(); + } } YAHOO.util.Event.preventDefault(e); } @@ -188,6 +188,7 @@ foreach my $val (editable_bug_fields()) { if (Bugzilla->user->is_timetracker) { push @chfields, "work_time"; } else { + @chfields = grep($_ ne "deadline", @chfields); @chfields = grep($_ ne "estimated_time", @chfields); @chfields = grep($_ ne "remaining_time", @chfields); } diff --git a/skins/standard/global.css b/skins/standard/global.css index 47cebdeac..f95d4e644 100644 --- a/skins/standard/global.css +++ b/skins/standard/global.css @@ -413,6 +413,12 @@ dl dl > dt { white-space: normal !important; } +/* Arrow buttons are buttons with only ↑, ↓, ← or → on + * them. We want these to look a little less spidery. */ +.arrow_button { + font-size: 150%; +} + /* Style of the attachment table and time tracking table */ #attachment_table { border-collapse: collapse; @@ -564,30 +570,3 @@ input.required, select.required, span.required_explanation { border: 2px solid #B70000; background-color: #FFEBEB; } - -/*****************/ -/* colchange.cgi */ -/*****************/ - -.image_button { - background-repeat: no-repeat; - background-position: center center; - width: 30px; - height: 20px; -} - -#select_button { - background-image: url(global/right.png); -} - -#deselect_button { - background-image: url(global/left.png); -} - -#up_button { - background-image: url(global/up.png); -} - -#down_button { - background-image: url(global/down.png); -} diff --git a/skins/standard/global/down.png b/skins/standard/global/down.png Binary files differdeleted file mode 100644 index 78a9e631a..000000000 --- a/skins/standard/global/down.png +++ /dev/null diff --git a/skins/standard/global/left.png b/skins/standard/global/left.png Binary files differdeleted file mode 100644 index f8cb2b2dd..000000000 --- a/skins/standard/global/left.png +++ /dev/null diff --git a/skins/standard/global/right.png b/skins/standard/global/right.png Binary files differdeleted file mode 100644 index d02b707a6..000000000 --- a/skins/standard/global/right.png +++ /dev/null diff --git a/skins/standard/global/up.png b/skins/standard/global/up.png Binary files differdeleted file mode 100644 index 240d483df..000000000 --- a/skins/standard/global/up.png +++ /dev/null diff --git a/template/en/default/bug/comments.html.tmpl b/template/en/default/bug/comments.html.tmpl index 7b305a248..f9d7f0cf0 100644 --- a/template/en/default/bug/comments.html.tmpl +++ b/template/en/default/bug/comments.html.tmpl @@ -176,7 +176,7 @@ [% END %] >reply</a>] <script type="text/javascript"><!-- - addCollapseLink([% count %]); // --> + addCollapseLink([% count %], 'Toggle comment display'); // --> </script> </span> [% END %] diff --git a/template/en/default/bug/field.html.tmpl b/template/en/default/bug/field.html.tmpl index a7e318c4d..4ed686248 100644 --- a/template/en/default/bug/field.html.tmpl +++ b/template/en/default/bug/field.html.tmpl @@ -226,22 +226,31 @@ 'keyword_autocomplete'); </script> [% END %] -[% ELSIF field.type == constants.FIELD_TYPE_TEXTAREA %] - <div class="uneditable_textarea">[% value FILTER html %]</div> -[% ELSIF field.type == constants.FIELD_TYPE_BUG_ID %] - [% IF value %] - [% value FILTER bug_link(value, use_alias => 1) FILTER none %] - [% END %] -[% ELSIF field.type == constants.FIELD_TYPE_BUG_URLS %] - [% '<ul class="bug_urls">' IF value.size %] - [% FOREACH bug_url = value %] - <li> - [% PROCESS bug_url_link bug_url = bug_url %] - </li> - [% END %] - [% '</ul>' IF value.size %] [% ELSE %] - [% value.join(', ') FILTER html %] + [% SWITCH field.type %] + [% CASE constants.FIELD_TYPE_TEXTAREA %] + <div class="uneditable_textarea">[% value FILTER html %]</div> + [% CASE constants.FIELD_TYPE_BUG_ID %] + [% IF value %] + [% value FILTER bug_link(value, use_alias => 1) FILTER none %] + [% END %] + [% CASE [ constants.FIELD_TYPE_SINGLE_SELECT + constants.FIELD_TYPE_MULTI_SELECT ] %] + [% FOREACH val = value %] + [% display_value(field.name, val) FILTER html %] + [% ', ' UNLESS loop.last() %] + [% END %] + [% CASE constants.FIELD_TYPE_BUG_URLS %] + [% '<ul class="bug_urls">' IF value.size %] + [% FOREACH bug_url = value %] + <li> + [% PROCESS bug_url_link bug_url = bug_url %] + </li> + [% END %] + [% '</ul>' IF value.size %] + [% CASE %] + [% value.join(', ') FILTER html %] + [% END %] [% END %] [% Hook.process('end_field_column') %] [% '</td>' IF NOT no_tds %] diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl index b13055c38..ff7e5d371 100644 --- a/template/en/default/list/change-columns.html.tmpl +++ b/template/en/default/list/change-columns.html.tmpl @@ -57,8 +57,7 @@ <tr> <th><div id="avail_header" class="bz_default_hidden">Available Columns</div></th> <th></th> - <th>Selected Columns</th> - <th></th> + <th colspan="2">Selected Columns</th> </tr> <tr> <td> @@ -68,11 +67,13 @@ </select> </td> <td> - <input class="image_button bz_default_hidden" type="button" - id="select_button" name="select" onclick="move_select()"> + <button type="button" id="select_button" name="select" + class="bz_default_hidden arrow_button" + onclick="move_select()">→</button> <br><br> - <input class="image_button bz_default_hidden" type="button" - id="deselect_button" name="deselect" onclick="move_deselect()"> + <button type="button" id="deselect_button" name="deselect" + class="bz_default_hidden arrow_button" + onclick="move_deselect()">←</button> </td> <td> <select name="selected_columns" id="selected_columns" @@ -93,11 +94,13 @@ </select> </td> <td> - <input class="image_button bz_default_hidden" type="button" - id="up_button" name="up" onclick="move_up()"> + <button type="button" id="up_button" name="up" + class="bz_default_hidden arrow_button" + onclick="move_up()">↑</button> <br><br> - <input class="image_button bz_default_hidden" type="button" - id="down_button" name="down" onclick="move_down()"> + <button type="button" id="down_button" name="down" + class="bz_default_hidden arrow_button" + onclick="move_down()">↓</button> </td> </tr> </table> diff --git a/template/en/default/list/list.js.tmpl b/template/en/default/list/list.js.tmpl deleted file mode 100644 index 7e9664c43..000000000 --- a/template/en/default/list/list.js.tmpl +++ /dev/null @@ -1,37 +0,0 @@ -[%# The contents of this file are subject to the Mozilla Public - # License Version 1.1 (the "License"); you may not use this file - # except in compliance with the License. You may obtain a copy of - # the License at http://www.mozilla.org/MPL/ - # - # Software distributed under the License is distributed on an "AS - # IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or - # implied. See the License for the specific language governing - # rights and limitations under the License. - # - # The Original Code is the Bugzilla Bug Tracking System. - # - # The Initial Developer of the Original Code is Netscape Communications - # Corporation. Portions created by Netscape are - # Copyright (C) 1998 Netscape Communications Corporation. All - # Rights Reserved. - # - # Contributor(s): Gervase Markham <gerv@gerv.net> - #%] - -// Note: only publicly-accessible bugs (those not in any group) will be -// listed when using this JavaScript format. This is to prevent malicious -// sites stealing information about secure bugs. - -bugs = new Array; - -[% FOREACH bug = bugs %] - bugs[[% bug.bug_id %]] = [ - [% FOREACH column = displaycolumns %] - "[%- bug.$column FILTER js -%]"[% "," UNLESS loop.last %] - [% END %] - ]; -[% END %] - -if (window.buglistCallback) { - buglistCallback(bugs); -} diff --git a/template/en/default/pages/release-notes.html.tmpl b/template/en/default/pages/release-notes.html.tmpl index 6402814e1..3cba64406 100644 --- a/template/en/default/pages/release-notes.html.tmpl +++ b/template/en/default/pages/release-notes.html.tmpl @@ -29,7 +29,7 @@ <ul class="bz_toc"> <li><a href="#v42_introduction">Introduction</a></li> - <!-- li><a href="#v42_point">Updates in this 4.2.x Release</a></li --> + <li><a href="#v42_point">Updates in this 4.2.x Release</a></li> <li><a href="#v42_req">Minimum Requirements</a></li> <li><a href="#v42_feat">New Features and Improvements</a></li> <li><a href="#v42_issues">Outstanding Issues</a></li> @@ -51,8 +51,56 @@ in between your version and this one, <strong>particularly the Upgrading section of each version's release notes</strong>.</p> -<!-- h2 id="v42_point">Updates in this 4.2.x Release</h2 --> +<h2 id="v42_point">Updates in this 4.2.x Release</h2> +<h3>4.2.1</h3> + +<p>This release fixes two security issues. See the + <a href="http://www.bugzilla.org/security/3.6.8/">Security Advisory</a> + for details.</p> + +<p>In addition, the following important fixes/changes have been made in this + release:</p> + +<ul> + <li>Due to a regression introduced when fixing CVE-2012-0453, if an XML-RPC + client sets the charset as part of its Content-Type header, we were + incorrectly rejecting the request. The header is now correctly parsed. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=731219">[% terms.Bug %] 731219</a>)</li> + <li>Email notifications about status changes in blockers were incorrectly + formatted. Several pieces of text were missing in the emails. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=731586">[% terms.Bug %] 731586</a>)</li> + <li>Many [% terms.bugs %] related to the searching system have been fixed. + (<a href="https://bugzilla.mozilla.org/buglist.cgi?bug_id=58179,715270,730984,731163,737436,745320"> + [% terms.Bugs %] 58179, 715270, 730984, 731163, 737436 and 745320</a>)</li> + <li>When using the QuickSearch box, complex queries are now parsed correctly. + It also behaves correctly with non-ASCII characters (such as é, ä, ü, etc.). + (<a href="https://bugzilla.mozilla.org/buglist.cgi?bug_id=554819,663377,730207"> + [% terms.Bugs %] 554819, 663377 and 730207</a>)</li> + <li>The 'take' link besides the assignee field now works correctly when + the <kbd>usemenuforusers</kbd> parameter is turned on. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=734997">[% terms.Bug %] 734997</a>)</li> + <li>URLs in the 'Total' row at the bottom of tabular reports were broken + when JavaScript was enabled and a user field was used for the vertical + axis. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=731323">[% terms.Bug %] 731323</a>)</li> + <li>Some performance problems have been fixed for installations with many + products, components or versions. + (<a href="https://bugzilla.mozilla.org/buglist.cgi?bug_id=695514,731055"> + [% terms.Bugs %] 695514 and 731055</a>)</li> + <li>A new hook named <kbd>buglist_column_joins</kbd> has been added to let + extensions alter the <kbd>Bugzilla::Search::COLUMN_JOINS</kbd> hash. + Now more fields can be displayed as columns in buglists, in combination + with the already existing <kbd>buglist_columns</kbd> hook. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=743991">[% terms.Bug %] 743991</a>)</li> + <li>A new hook named <kbd>error_catch</kbd> has been added to let extensions + alter the way errors are thrown. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=745197">[% terms.Bug %] 745197</a>)</li> + <li>A new hook named <kbd>admin_editusers_action</kbd> has been added to let + extensions alter the behavior of <kbd>editusers.cgi</kbd>. This lets you add + new features to this script very easily. + (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=730794">[% terms.Bug %] 730794</a>)</li> +</ul> <h2 id="v42_req">Minimum Requirements</h2> |
