diff options
61 files changed, 2388 insertions, 2317 deletions
diff --git a/docs/html/Bugzilla-Guide.html b/docs/html/Bugzilla-Guide.html index c40121bc0..4c91b1051 100644 --- a/docs/html/Bugzilla-Guide.html +++ b/docs/html/Bugzilla-Guide.html @@ -1,7 +1,7 @@ <HTML ><HEAD ><TITLE ->The Bugzilla Guide</TITLE +>The Bugzilla Guide - 2.17.4 Development Release</TITLE ><META NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ @@ -43,7 +43,7 @@ CLASS="title" ><A NAME="AEN2" ></A ->The Bugzilla Guide</H1 +>The Bugzilla Guide - 2.17.4 Development Release</H1 ><H3 CLASS="author" ><A @@ -55,18 +55,18 @@ CLASS="author" ><A NAME="AEN9" ></A +>Jacob Steenhagen</H3 +><H3 +CLASS="corpauthor" >The Bugzilla Team</H3 ><P -CLASS="edition" ->2.17.3 Development Release Edition </P -><P CLASS="pubdate" ->2003-01-02<BR></P +>2003-02-16<BR></P ><DIV ><DIV CLASS="abstract" ><A -NAME="AEN15" +NAME="AEN14" ></A ><P ></P @@ -332,7 +332,7 @@ HREF="#variants" ><DL ><DT >D.1. <A -HREF="#rhbugzilla" +HREF="#variant-redhat" >Red Hat Bugzilla</A ></DT ><DT @@ -487,7 +487,7 @@ NAME="copyright" ></A >1.1. Copyright Information</H1 ><A -NAME="AEN34" +NAME="AEN33" ></A ><TABLE BORDER="0" @@ -599,7 +599,7 @@ NAME="newversions" ></A >1.3. New Versions</H1 ><P -> This is the 2.17.3 version of The Bugzilla Guide. It is so named +> This is the 2.17.4 version of The Bugzilla Guide. It is so named to match the current version of Bugzilla. This version of the guide, like its associated Bugzilla version is a @@ -667,66 +667,115 @@ NAME="credits" contribution to the Bugzilla community: </P ><P -> <A -HREF="mailto://mbarnson@sisna.com" -TARGET="_top" ->Matthew P. Barnson</A -> - for the Herculaean task of pulling together the Bugzilla Guide and - shepherding it to 2.14. - </P +></P +><DIV +CLASS="variablelist" +><DL +><DT +>Matthew P. Barnson <TT +CLASS="email" +><<A +HREF="mailto:mbarnson@sisna.com" +>mbarnson@sisna.com</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://terry@mozilla.org" -TARGET="_top" ->Terry Weissman</A -> - for initially writing Bugzilla and creating the - README upon which the UNIX installation documentation is largely based. - </P +>for the Herculaean task of pulling together the Bugzilla Guide + and shepherding it to 2.14. + </P +></DD +><DT +>Terry Weissman <TT +CLASS="email" +><<A +HREF="mailto:terry@mozilla.org" +>terry@mozilla.org</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://tara@tequilarista.org" -TARGET="_top" ->Tara Hernandez</A -> - for keeping Bugzilla development going - strong after Terry left mozilla.org - </P +>for initially writing Bugzilla and creating the README upon + which the UNIX installation documentation is largely based. + </P +></DD +><DT +>Tara Hernandez <TT +CLASS="email" +><<A +HREF="mailto:tara@tequilarists.org" +>tara@tequilarists.org</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://dkl@redhat.com" -TARGET="_top" ->Dave Lawrence</A -> - for providing insight into the key differences between Red Hat's - customized Bugzilla, and being largely responsible for the "Red - Hat Bugzilla" appendix - </P +>for keeping Bugzilla development going strong after Terry left + mozilla.org and for running landfill. + </P +></DD +><DT +>Dave Lawrence <TT +CLASS="email" +><<A +HREF="mailto:dkl@redhat.com" +>dkl@redhat.com</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://endico@mozilla.org" -TARGET="_top" ->Dawn Endico</A -> for - being a hacker extraordinaire and putting up with my incessant - questions and arguments on irc.mozilla.org in #mozwebtools - </P +>for providing insight into the key differences between Red + Hat's customized Bugzilla, and being largely responsible for + <A +HREF="#variant-redhat" +>Section D.1</A +>. + </P +></DD +><DT +>Dawn Endico <TT +CLASS="email" +><<A +HREF="mailto:endico@mozilla.org" +>endico@mozilla.org</A +>></TT +></DT +><DD +><P +>for being a hacker extraordinaire and putting up with Matthew's + incessant questions and arguments on irc.mozilla.org in #mozwebtools + </P +></DD +><DT +>Jacob Steenhagen <TT +CLASS="email" +><<A +HREF="mailto:jake@bugzilla.org" +>jake@bugzilla.org</A +>></TT +></DT +><DD +><P +>for taking over documentation during the 2.17 development + period. + </P +></DD +></DL +></DIV ><P > Last but not least, all the members of the <A HREF="news://news.mozilla.org/netscape/public/mozilla/webtools" TARGET="_top" -> netscape.public.mozilla.webtools</A -> newsgroup. Without your discussions, insight, suggestions, and patches, this could never have happened. +>news://news.mozilla.org/netscape/public/mozilla/webtools</A +> + newsgroup. Without your discussions, insight, suggestions, and patches, + this could never have happened. </P ><P > Thanks also go to the following people for significant contributions - to this documentation (in no particular order): - </P -><P -> Zach Liption, Andrew Pearson, Spencer Smith, Eric Hanson, Kevin Brannen, - Ron Teitelbaum, Jacob Steenhagen, Joe Robins, Gervase Markham. + to this documentation (in alphabetical order): + Andrew Pearson, Ben FrantzDale, Eric Hanson, Gervase Markham, Joe Robins, Kevin Brannen, Ron Teitelbaum, Spencer Smith, Zach Liption + . </P ></DIV ><DIV @@ -742,7 +791,7 @@ NAME="conventions" ><DIV CLASS="informaltable" ><A -NAME="AEN80" +NAME="AEN110" ></A ><P ></P @@ -1809,7 +1858,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN340" +NAME="AEN370" ></A >3.2.1. Autolinkification</H2 ><P @@ -1957,7 +2006,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN369" +NAME="AEN399" ></A >3.2.5. Filing Bugs</H2 ><P @@ -2896,7 +2945,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN556" +NAME="AEN586" ></A >4.1.5.1. DBI</H3 ><P @@ -2911,7 +2960,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN559" +NAME="AEN589" ></A >4.1.5.2. Data::Dumper</H3 ><P @@ -2925,7 +2974,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN562" +NAME="AEN592" ></A >4.1.5.3. MySQL-related modules</H3 ><P @@ -2951,7 +3000,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN567" +NAME="AEN597" ></A >4.1.5.4. TimeDate modules</H3 ><P @@ -2967,7 +3016,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN570" +NAME="AEN600" ></A >4.1.5.5. GD (optional)</H3 ><P @@ -3022,7 +3071,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN577" +NAME="AEN607" ></A >4.1.5.6. Chart::Base (optional)</H3 ><P @@ -3037,7 +3086,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN580" +NAME="AEN610" ></A >4.1.5.7. Template Toolkit</H3 ><P @@ -3106,7 +3155,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN590" +NAME="AEN620" ></A >4.1.7. Bugzilla</H2 ><P @@ -3256,7 +3305,7 @@ WIDTH="100%" COLOR="#000000" ><PRE CLASS="programlisting" -> perl -pi -e 's@#\!/usr/bonsaitools/bin/perl@#\!/usr/bin/perl@' *cgi *pl Bug.pm processmail syncshadowdb +> perl -pi -e 's@#\!/usr/bonsaitools/bin/perl@#\!/usr/bin/perl@' *cgi *pl Bug.pm syncshadowdb </PRE ></FONT ></TD @@ -3276,7 +3325,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN615" +NAME="AEN645" ></A >4.1.8. Setting Up the MySQL Database</H2 ><P @@ -3449,7 +3498,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN651" +NAME="AEN681" ></A >4.1.9. <TT CLASS="filename" @@ -3602,287 +3651,9 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN683" -></A ->4.1.10. Securing MySQL</H2 -><P ->If you followed the installation instructions for setting up your - "bugs" and "root" user in MySQL, much of this should not apply to you. - If you are upgrading an existing installation of Bugzilla, you should - pay close attention to this section.</P -><P ->Most MySQL installs have "interesting" default security - parameters: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->mysqld defaults to running as root</TD -></TR -><TR -><TD ->it defaults to allowing external network connections</TD -></TR -><TR -><TD ->it has a known port number, and is easy to detect</TD -></TR -><TR -><TD ->it defaults to no passwords whatsoever</TD -></TR -><TR -><TD ->it defaults to allowing "File_Priv"</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->This means anyone from anywhere on the Internet can not only drop - the database with one SQL command, and they can write as root to the - system.</P -><P ->To see your permissions do: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->bash#</TT -> - - <B -CLASS="command" ->mysql -u root -p</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->use mysql;</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->show tables;</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->select * from user;</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->select * from db;</B -> - </TT -> - </TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->To fix the gaping holes: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->DELETE FROM user WHERE User='';</TD -></TR -><TR -><TD ->UPDATE user SET Password=PASSWORD('new_password') WHERE - user='root';</TD -></TR -><TR -><TD ->FLUSH PRIVILEGES;</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->If you're not running "mit-pthreads" you can use: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->GRANT USAGE ON *.* TO bugs@localhost;</TD -></TR -><TR -><TD ->GRANT ALL ON bugs.* TO bugs@localhost;</TD -></TR -><TR -><TD ->REVOKE DROP ON bugs.* FROM bugs@localhost;</TD -></TR -><TR -><TD ->FLUSH PRIVILEGES;</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->With "mit-pthreads" you'll need to modify the "globals.pl" - Mysql->Connect line to specify a specific host name instead of - "localhost", and accept external connections: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->GRANT USAGE ON *.* TO bugs@bounce.hop.com;</TD -></TR -><TR -><TD ->GRANT ALL ON bugs.* TO bugs@bounce.hop.com;</TD -></TR -><TR -><TD ->REVOKE DROP ON bugs.* FROM bugs@bounce.hop.com;</TD -></TR -><TR -><TD ->FLUSH PRIVILEGES;</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->Consider also: - <P -></P -><OL -TYPE="1" -><LI -><P ->Turning off external networking with "--skip-networking", - unless you have "mit-pthreads", in which case you can't. Without - networking, MySQL connects with a Unix domain socket.</P -></LI -><LI -><P ->using the --user= option to mysqld to run it as an - unprivileged user.</P -></LI -><LI -><P ->running MySQL in a chroot jail</P -></LI -><LI -><P ->running the httpd in a chroot jail</P -></LI -><LI -><P ->making sure the MySQL passwords are different from the OS - passwords (MySQL "root" has nothing to do with system - "root").</P -></LI -><LI -><P ->running MySQL on a separate untrusted machine</P -></LI -><LI -><P ->making backups ;-)</P -></LI -></OL -> - </P -></DIV -><DIV -CLASS="section" -><HR><H2 -CLASS="section" -><A -NAME="AEN749" +NAME="AEN713" ></A ->4.1.11. Configuring Bugzilla</H2 +>4.1.10. Configuring Bugzilla</H2 ><P > You should run through the parameters on the Edit Parameters page (link in the footer) and set them all to appropriate values. @@ -3906,7 +3677,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN755" +NAME="AEN719" ></A >4.2.1. Dependency Charts</H2 ><P @@ -3970,7 +3741,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN770" +NAME="AEN734" ></A >4.2.2. Bug Graphs</H2 ><P @@ -4029,7 +3800,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN783" +NAME="AEN747" ></A >4.2.3. The Whining Cron</H2 ><P @@ -4367,181 +4138,9 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="htaccess" -></A ->4.2.6. <TT -CLASS="filename" ->.htaccess</TT -> - files and security</H2 -><P ->To enhance the security of your Bugzilla installation, Bugzilla's - <TT -CLASS="filename" ->checksetup.pl</TT -> script will generate - <I -CLASS="glossterm" -> <TT -CLASS="filename" ->.htaccess</TT -> - </I -> - - files which the Apache webserver can use to restrict access to the - bugzilla data files. - These .htaccess files will not work with Apache 1.2.x - but this - has security holes, so you shouldn't be using it anyway. - <DIV -CLASS="note" -><P -></P -><TABLE -CLASS="note" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="../images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->If you are using an alternate provider of - <SPAN -CLASS="productname" ->webdot</SPAN -> - - services for graphing (as described when viewing - <TT -CLASS="filename" ->editparams.cgi</TT -> - - in your web browser), you will need to change the ip address in - <TT -CLASS="filename" ->data/webdot/.htaccess</TT -> - - to the ip address of the webdot server that you are using.</P -></TD -></TR -></TABLE -></DIV -> - </P -><P ->The default .htaccess file may not provide adequate access - restrictions, depending on your web server configuration. Be sure to - check the <Directory> entries for your Bugzilla directory so that - the - <TT -CLASS="filename" ->.htaccess</TT -> - - file is allowed to override web server defaults. For instance, let's - assume your installation of Bugzilla is installed to - <TT -CLASS="filename" ->/usr/local/bugzilla</TT -> - - . You should have this <Directory> entry in your - <TT -CLASS="filename" ->httpd.conf</TT -> - - file:</P -><P -> -<TABLE -BORDER="0" -BGCOLOR="#E0E0E0" -WIDTH="100%" -><TR -><TD -><FONT -COLOR="#000000" -><PRE -CLASS="programlisting" -> <Directory /usr/local/bugzilla/> - Options +FollowSymLinks +Indexes +Includes +ExecCGI - AllowOverride All -</Directory> -</PRE -></FONT -></TD -></TR -></TABLE -> - - </P -><P ->The important part above is - <SPAN -CLASS="QUOTE" ->"AllowOverride All"</SPAN -> - - . Without that, the - <TT -CLASS="filename" ->.htaccess</TT -> - - file created by - <TT -CLASS="filename" ->checksetup.pl</TT -> - - will not have sufficient permissions to protect your Bugzilla - installation.</P -><P ->If you are using Internet Information Server (IIS) or another - web server which does not observe - <TT -CLASS="filename" ->.htaccess</TT -> - conventions, you can disable their creation by editing - <TT -CLASS="filename" ->localconfig</TT -> - and setting the - <TT -CLASS="varname" ->$create_htaccess</TT -> - variable to - <TT -CLASS="parameter" -><I ->0</I -></TT ->. - </P -></DIV -><DIV -CLASS="section" -><HR><H2 -CLASS="section" -><A NAME="directoryindex" ></A ->4.2.7. <TT +>4.2.6. <TT CLASS="filename" >directoryindex</TT > for the Bugzilla default page.</H2 @@ -4568,7 +4167,7 @@ CLASS="section" ><A NAME="mod_perl" ></A ->4.2.8. Bugzilla and <TT +>4.2.7. Bugzilla and <TT CLASS="filename" >mod_perl</TT ></H2 @@ -4585,7 +4184,7 @@ CLASS="section" ><A NAME="mod-throttle" ></A ->4.2.9. <TT +>4.2.8. <TT CLASS="filename" >mod_throttle</TT > @@ -4775,11 +4374,11 @@ TARGET="_top" ></TABLE ></DIV ><DIV -CLASS="note" +CLASS="tip" ><P ></P ><TABLE -CLASS="note" +CLASS="tip" WIDTH="100%" BORDER="0" ><TR @@ -4788,9 +4387,9 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" ><IMG -SRC="../images/note.gif" +SRC="../images/tip.gif" HSPACE="5" -ALT="Note"></TD +ALT="Tip"></TD ><TD ALIGN="LEFT" VALIGN="TOP" @@ -4919,30 +4518,9 @@ CLASS="section" ><HR><H4 CLASS="section" ><A -NAME="win32-code-mail" +NAME="AEN863" ></A ->4.3.1.3.2. Making mail work</H4 -><P ->The easiest way to get mail working is to use the mail patches - on <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=124174" -TARGET="_top" ->bug - 124174</A ->. With any luck, this patch will receive the required - reviews and integrated into the main Bugzilla distribution very soon. - Until that happens, there's at least one report of this patch working - well on Windows. - </P -></DIV -><DIV -CLASS="section" -><HR><H4 -CLASS="section" -><A -NAME="AEN930" -></A ->4.3.1.3.3. System Calls</H4 +>4.3.1.3.2. System Calls</H4 ><P >In order to get system calls to work on win32's perl, you need to tell the windows shell what interpreter to use. This is done by @@ -4971,7 +4549,7 @@ WIDTH="100%" COLOR="#000000" ><PRE CLASS="programlisting" -> system("./processmail", $id, $exporter); +> system("$webdotbase","-Tpng","-o","$pngfilename","$filename"); </PRE ></FONT ></TD @@ -4989,19 +4567,12 @@ WIDTH="100%" COLOR="#000000" ><PRE CLASS="programlisting" -> system("C:\\perl\\bin\\perl", "processmail", $id, $exporter); +> system("C:\\perl\\bin\\perl", "$webdotbase","-Tpng","-o","$pngfilename","$filename"); </PRE ></FONT ></TD ></TR ></TABLE -><P ->Notice that the <TT -CLASS="computeroutput" ->./</TT -> is also - removed. - </P ><DIV CLASS="tip" ><P @@ -5040,6 +4611,51 @@ CLASS="productname" ></TR ></TABLE ></DIV +><DIV +CLASS="note" +><P +></P +><TABLE +CLASS="note" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>It appears that the only <TT +CLASS="function" +>system</TT +> call + remaining in the Bugzilla codebase is in + <TT +CLASS="filename" +>showdependencygraph.cgi</TT +>. Not changing this + file will only cause dependency graphs to not function if the + <TT +CLASS="option" +>webdotbase</TT +> paramater points to a local + installation of <A +HREF="http://www.graphviz.org" +TARGET="_top" +>GraphViz</A +>. + </P +></TD +></TR +></TABLE +></DIV ></DIV ></DIV ><DIV @@ -5055,8 +4671,8 @@ NAME="win32-http" able to handle Bugzilla; however, the Bugzilla Team still recommends Apache whenever asked. No matter what web server you choose, be sure to pay attention to the security notes in <A -HREF="#security" ->Section 5.6</A +HREF="#security-access" +>Section 5.6.4</A >. More information on configuring specific web servers can be found in <A @@ -5256,8 +4872,8 @@ CLASS="glossterm" should be able to handle Bugzilla. No matter what web server you choose, but especially if you choose something other than Apache, you should be sure to read <A -HREF="#security" ->Section 5.6</A +HREF="#security-access" +>Section 5.6.4</A >. </P ><P @@ -5430,7 +5046,7 @@ COLOR="#000000" ><PRE CLASS="programlisting" > # don't allow people to retrieve non-cgi executable files or our private data -<FilesMatch ^(.*\.pl|.*localconfig.*|processmail|runtests.sh)$> +<FilesMatch ^(.*\.pl|.*localconfig.*|runtests.sh)$> deny from all </FilesMatch> <FilesMatch ^(localconfig.js|localconfig.rdf)$> @@ -5614,8 +5230,8 @@ CLASS="filename" >data</TT > directory are secured as described in <A -HREF="#security" ->Section 5.6</A +HREF="#security-access" +>Section 5.6.4</A >. </P ></DIV @@ -5677,12 +5293,14 @@ COLOR="#000000" ><PRE CLASS="programlisting" > ns_register_filter preauth GET /bugzilla/localconfig filter_deny +ns_register_filter preauth GET /bugzilla/localconfig~ filter_deny +ns_register_filter preauth GET /bugzilla/\#localconfig\# filter_deny ns_register_filter preauth GET /bugzilla/*.pl filter_deny -ns_register_filter preauth GET /bugzilla/localconfig filter_deny -ns_register_filter preauth GET /bugzilla/processmail filter_deny ns_register_filter preauth GET /bugzilla/syncshadowdb filter_deny ns_register_filter preauth GET /bugzilla/runtests.sh filter_deny - +ns_register_filter preauth GET /bugzilla/data/* filter_deny +ns_register_filter preauth GET /bugzilla/template/* filter_deny + proc filter_deny { why } { ns_log Notice "filter_deny" return "filter_return" @@ -5713,31 +5331,84 @@ ALT="Warning"></TD ALIGN="LEFT" VALIGN="TOP" ><P ->This doesn't appear to account for everything mentioned in - <A -HREF="#security" ->Section 5.6</A ->. In particular, it doesn't block access - to the <TT -CLASS="filename" ->data</TT -> or +>This probably doesn't account for all possible editor backup + files so you may wish to add some additional variations of <TT CLASS="filename" ->template</TT -> directories. It also - doesn't account for the editor backup files that were the topic of +>localconfig</TT +>. For more information, see <A HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383" TARGET="_top" >bug 186383</A ->, <A +> or <A HREF="http://online.securityfocus.com/bid/6501" TARGET="_top" >Bugtraq ID 6501</A +>. + </P +></TD +></TR +></TABLE +></DIV +><DIV +CLASS="note" +><P +></P +><TABLE +CLASS="note" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>If you are using webdot from research.att.com (the default + configuration for the <TT +CLASS="option" +>webdotbase</TT +> paramater), you + will need to allow access to <TT +CLASS="filename" +>data/webdot/*.dot</TT +> + for the reasearch.att.com machine. + </P +><P +>If you are using a local installation of <A +HREF="http://www.graphviz.org" +TARGET="_top" +>GraphViz</A +>, you will need to allow + everybody to access <TT +CLASS="filename" +>*.png</TT >, - and a partial cause for the 2.16.2 release. + <TT +CLASS="filename" +>*.gif</TT +>, <TT +CLASS="filename" +>*.jpg</TT +>, and + <TT +CLASS="filename" +>*.map</TT +> in the + <TT +CLASS="filename" +>data/webdot</TT +> directory. </P ></TD ></TR @@ -5762,7 +5433,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN1063" +NAME="AEN1009" ></A >4.5.1. Bundle::Bugzilla makes me upgrade to Perl 5.6.1</H2 ><P @@ -5787,7 +5458,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN1068" +NAME="AEN1014" ></A >4.5.2. DBD::Sponge::db prepare failed</H2 ><P @@ -7142,60 +6813,227 @@ VALIGN="TOP" ><P >These instructions must, of necessity, be somewhat vague since Bugzilla runs on so many different platforms. If you have refinements - of these directions for specific platforms, please submit them to - <A -HREF="mailto://mozilla-webtools@mozilla.org" + of these directions, please submit a bug to <A +HREF="http://bugzilla.mozilla.org/enter_bug.cgi?product=Bugzilla&component=Documentation" TARGET="_top" -> mozilla-webtools@mozilla.org</A -> +>Bugzilla Documentation</A +>. </P ></TD ></TR ></TABLE ></DIV +><DIV +CLASS="warning" +><P +></P +><TABLE +CLASS="warning" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/warning.gif" +HSPACE="5" +ALT="Warning"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>This is not meant to be a comprehensive list of every possible + security issue regarding the tools mentioned in this section. There is + no subsitute for reading the information written by the authors of any + software running on your system. + </P +></TD +></TR +></TABLE +></DIV +><DIV +CLASS="section" +><HR><H2 +CLASS="section" +><A +NAME="security-networking" +></A +>5.6.1. TCP/IP Ports</H2 +><P +>TCP/IP defines 65,000 some ports for trafic. Of those, Bugzilla + only needs 1... 2 if you need to use features that require e-mail such + as bug moving or the e-mail interface from contrib. You should audit + your server and make sure that you aren't listening on any ports you + don't need to be. You may also wish to use some kind of firewall + software to be sure that trafic can only be recieved on ports you + specify. + </P +></DIV +><DIV +CLASS="section" +><HR><H2 +CLASS="section" +><A +NAME="security-mysql" +></A +>5.6.2. MySQL</H2 +><P +>MySQL ships by default with many settings that should be changed. + By defaults it allows anybody to connect from localhost without a + password and have full administrative capabilities. It also defaults to + not have a root password (this is <EM +>not</EM +> the same as + the system root). Also, many installations default to running + <SPAN +CLASS="application" +>mysqld</SPAN +> as the system root. + </P ><P ->To secure your installation: - - <P ></P ><OL TYPE="1" ><LI ><P -> <EM ->There is no substitute for understanding the tools on your - system!</EM -> - - Read - <A -HREF="http://www.mysql.com/doc/P/r/Privilege_system.html" -TARGET="_top" -> The MySQL Privilege System</A -> - until you can recite it from memory!</P +>Consult the documentation that came with your system for + information on making <SPAN +CLASS="application" +>mysqld</SPAN +> run as an + unprivleged user. + </P ></LI ><LI ><P ->Lock down <TT +>You should also be sure to disable the anonymous user account + and set a password for the root user. This is accomplished using the + following commands: + </P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><FONT +COLOR="#000000" +><PRE +CLASS="programlisting" +> <TT +CLASS="prompt" +>bash$</TT +> mysql mysql +<TT +CLASS="prompt" +>mysql></TT +> DELETE FROM user WHERE user = ''; +<TT +CLASS="prompt" +>mysql></TT +> UPDATE user SET password = password('<TT +CLASS="replaceable" +><I +>new_password</I +></TT +>') WHERE user = 'root'; +<TT +CLASS="prompt" +>mysql></TT +> FLUSH PRIVILEGES; + </PRE +></FONT +></TD +></TR +></TABLE +><P +>From this point forward you will need to use + <B +CLASS="command" +>mysql -u root -p</B +> and enter + <TT +CLASS="replaceable" +><I +>new_password</I +></TT +> when prompted when using the + mysql client. + </P +></LI +><LI +><P +>If you run MySQL on the same machine as your httpd server, you + should consider disabling networking from within MySQL by adding + the following to your <TT CLASS="filename" ->/etc/inetd.conf</TT ->. Heck, disable - inet entirely on this box. It should only listen to port 25 for - Sendmail and port 80 for Apache.</P +>/etc/my.conf</TT +>: + </P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><FONT +COLOR="#000000" +><PRE +CLASS="programlisting" +> [myslqd] +# Prevent network access to MySQL. +skip-networking + </PRE +></FONT +></TD +></TR +></TABLE ></LI ><LI ><P ->Do not run Apache as - <SPAN +>You may also consider running MySQL, or even all of Bugzilla + in a chroot jail; however, instructions for doing that are beyond + the scope of this document. + </P +></LI +></OL +></DIV +><DIV +CLASS="section" +><HR><H2 +CLASS="section" +><A +NAME="security-daemon" +></A +>5.6.3. Daemon Accounts</H2 +><P +>Many daemons, such as Apache's httpd and MySQL's mysqld default to + running as either <SPAN +CLASS="QUOTE" +>"root"</SPAN +> or <SPAN CLASS="QUOTE" >"nobody"</SPAN -> - - . This will require very lax permissions in your Bugzilla - directories. Run it, instead, as a user with a name, set via your - httpd.conf file. - <DIV +>. Running + as <SPAN +CLASS="QUOTE" +>"root"</SPAN +> introduces obvious security problems, but the + problems introduced by running everything as <SPAN +CLASS="QUOTE" +>"nobody"</SPAN +> may + not be so obvious. Basically, if you're running every daemon as + <SPAN +CLASS="QUOTE" +>"nobody"</SPAN +> and one of them gets comprimised, they all get + comprimised. For this reason it is recommended that you create a user + account for each daemon. + </P +><DIV CLASS="note" ><P ></P @@ -7216,62 +7054,232 @@ ALT="Note"></TD ALIGN="LEFT" VALIGN="TOP" ><P -> <SPAN -CLASS="QUOTE" ->"nobody"</SPAN -> - - is a real user on UNIX systems. Having a process run as user id - <SPAN -CLASS="QUOTE" ->"nobody"</SPAN -> - - is absolutely no protection against system crackers versus using - any other user account. As a general security measure, I recommend - you create unique user ID's for each daemon running on your system - and, if possible, use "chroot" to jail that process away from the - rest of your system.</P +>You will need to set the <TT +CLASS="varname" +>webservergroup</TT +> to + the group you created for your webserver to run as in + <TT +CLASS="filename" +>localconfig</TT +>. This will allow + <B +CLASS="command" +>./checksetup.pl</B +> to better adjust the file + permissions on your Bugzilla install so as to not require making + anything world-writable. + </P ></TD ></TR ></TABLE ></DIV +></DIV +><DIV +CLASS="section" +><HR><H2 +CLASS="section" +><A +NAME="security-access" +></A +>5.6.4. Web Server Access Controls</H2 +><P +>There are many files that are placed in the Bugzilla directory + area that should not be accessable from the web. Because of the way + Bugzilla is currently layed out, the list of what should and should + not be accessible is rather complicated. A new installation method + is currently in the works which should solve this by allowing files + that shouldn't be accessible from the web to be placed in directory + outside the webroot. See + <A +HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=44659" +TARGET="_top" +>bug + 44659</A +> for more information. + </P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>In the main Bugzilla directory, you should:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block: + <TT +CLASS="filename" +>*.pl</TT +>, <TT +CLASS="filename" +>*localconfig*</TT +>, <TT +CLASS="filename" +>runtests.sh</TT > - </P + </P ></LI ><LI ><P ->Ensure you have adequate access controls for the - <TT +>But allow: + <TT CLASS="filename" ->$BUGZILLA_HOME/data/</TT -> directory, as well as the - <TT +>localconfig.js</TT +>, <TT CLASS="filename" ->$BUGZILLA_HOME/localconfig</TT -> file. - The localconfig file stores your "bugs" database account password. - In addition, some - files under <TT +>localconfig.rdf</TT +> + </P +></LI +></UL +></LI +><LI +><P +>In <TT CLASS="filename" ->$BUGZILLA_HOME/data/</TT -> store sensitive - information. - </P +>data</TT +>:</P ><P ->Also, beware that some text editors create backup files in the - current working directory so you need to also secure files like - <TT +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +><LI +><P +>But allow: + <TT CLASS="filename" ->localconfig~</TT ->. - </P +>duplicates.rdf</TT +> + </P +></LI +></UL +></LI +><LI +><P +>In <TT +CLASS="filename" +>data/webdot</TT +>:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>If you use a remote webdot server:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +><LI +><P +>But allow + <TT +CLASS="filename" +>*.dot</TT +> + only for the remote webdot server</P +></LI +></UL +></LI +><LI +><P +>Otherwise, if you use a local GraphViz:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +><LI +><P +>But allow: + <TT +CLASS="filename" +>*.png</TT +>, <TT +CLASS="filename" +>*.gif</TT +>, <TT +CLASS="filename" +>*.jpg</TT +>, <TT +CLASS="filename" +>*.map</TT +> + </P +></LI +></UL +></LI +><LI +><P +>And if you don't use any dot:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +></UL +></LI +></UL +></LI +><LI +><P +>In <TT +CLASS="filename" +>Bugzilla</TT +>:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +></UL +></LI +><LI +><P +>In <TT +CLASS="filename" +>template</TT +>:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +></UL +></LI +></UL ><DIV -CLASS="note" +CLASS="tip" ><P ></P ><TABLE -CLASS="note" +CLASS="tip" WIDTH="100%" BORDER="0" ><TR @@ -7280,102 +7288,64 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" ><IMG -SRC="../images/note.gif" +SRC="../images/tip.gif" HSPACE="5" -ALT="Note"></TD +ALT="Tip"></TD ><TD ALIGN="LEFT" VALIGN="TOP" ><P ->Simply blocking <TT -CLASS="computeroutput" ->.*localconfig.*</TT -> - won't work because the QuickSearch feature requires the web browser - to be able to retrieve <TT +>Bugzilla ships with the ability to generate + <TT CLASS="filename" ->localconfig.js</TT -> and - others may be introduced in the future (see - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383" -TARGET="_top" ->bug - 186383</A -> for more information. - </P +>.htaccess</TT +> files instructing + <A +HREF="#gloss-apache" +><I +CLASS="glossterm" +>Apache</I +></A +> which files + should and should not be accessible. For more information, see + <A +HREF="#http-apache" +>Section 4.4.1</A +>. + </P ></TD ></TR ></TABLE ></DIV ><P ->Bugzilla provides default <TT -CLASS="filename" ->.htaccess</TT -> files - to protect the most common Apache installations. However, you should - verify these are adequate according to the site-wide security policy - of your web server, and ensure that the <TT -CLASS="filename" ->.htaccess</TT -> - files are allowed to <SPAN -CLASS="QUOTE" ->"override"</SPAN -> default permissions set - in your Apache configuration files. Covering Apache security is beyond - the scope of this Guide; please consult the Apache documentation for - details. - </P -><P ->If you are using a web server that does not support the - <TT -CLASS="filename" ->.htaccess</TT -> control method, - <EM ->you are at risk!</EM -> - - After installing, check to see if you can view the file - <TT +>You should test to make sure that the files mentioned above are + not accessible from the Internet, especially your + <TT CLASS="filename" >localconfig</TT -> in your web browser (e.g.: - <A +> file which contains your database + password. To test, simply point your web browser at the file; for + example, to test mozilla.org's installation, we'd try to access + <A HREF="http://bugzilla.mozilla.org/localconfig" TARGET="_top" -> http://bugzilla.mozilla.org/localconfig</A -> - - ). If you can read the contents of this file, your web server has - not secured your bugzilla directory properly and you must fix this - problem before deploying Bugzilla. If, however, it gives you a - "Forbidden" error, then it probably respects the .htaccess - conventions and you are good to go.</P -></LI -><LI -><P ->When you run checksetup.pl, the script will attempt to modify - various permissions on files which Bugzilla uses. If you do not have - a webservergroup set in the <TT -CLASS="filename" ->localconfig</TT -> file, - then Bugzilla will have to make certain files world readable and/or - writable. - <EM ->THIS IS INSECURE!</EM +>http://bugzilla.mozilla.org/localconfig</A +>. You should + get a <SPAN +CLASS="errorcode" +>403</SPAN +> <SPAN +CLASS="errorname" +>Forbidden</SPAN > - - . This means that anyone who can get access to your system can do - whatever they want to your Bugzilla installation.</P + error. + </P ><DIV -CLASS="note" +CLASS="caution" ><P ></P ><TABLE -CLASS="note" +CLASS="caution" WIDTH="100%" BORDER="0" ><TR @@ -7384,90 +7354,55 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" ><IMG -SRC="../images/note.gif" +SRC="../images/caution.gif" HSPACE="5" -ALT="Note"></TD +ALT="Caution"></TD ><TD ALIGN="LEFT" VALIGN="TOP" ><P ->This also means that if your webserver runs all cgi scripts - as the same user/group, anyone on the system who can run cgi - scripts will be able to take control of your Bugzilla - installation.</P +>Not following the instructions in this section, including + testing, may result in sensitive information being globally + accessible. + </P ></TD ></TR ></TABLE ></DIV +><DIV +CLASS="tip" ><P ->On Apache, you can use <TT -CLASS="filename" ->.htaccess</TT -> files to - protect access to these directories, as outlined in Bugs - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=57161" -TARGET="_top" -> 57161</A -> and - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383" -TARGET="_top" -> 186383</A -> - - for the <TT -CLASS="filename" ->localconfig</TT -> file, and - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=65572" -TARGET="_top" ->Bug - 65572</A -> - - for adequate protection in your <TT -CLASS="filename" ->data/</TT -> directory. - Also, don't forget about the <TT -CLASS="filename" ->template/</TT -> and - <TT -CLASS="filename" ->Bugzilla/</TT -> directories and to allow access to the - <TT -CLASS="filename" ->data/webdot</TT -> directory for the - <TT -CLASS="computeroutput" ->192.20.225.10</TT -> IP address if you are - using webdot from research.att.com. The easiest way to - accomplish this is to set <TT -CLASS="function" ->$create_htaccess</TT -> to 1 - in <TT -CLASS="filename" ->localconfig</TT ->. However, the information below - is provided for those that want to know exactly what is created. - </P +></P +><TABLE +CLASS="tip" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/tip.gif" +HSPACE="5" +ALT="Tip"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" ><P ->FIX ME BEFORE RELEASE!!!!! - Note the instructions which follow are Apache-specific. If you - use IIS, Netscape, or other non-Apache web servers, please consult - your system documentation for how to secure these files from being - transmitted to curious users.</P -></LI -></OL -> - </P +>You should check <A +HREF="#http" +>Section 4.4</A +> to see if instructions + have been included for your web server. You should also compare those + instructions with this list to make sure everything is properly + accounted for. + </P +></TD +></TR +></TABLE +></DIV +></DIV ></DIV ><DIV CLASS="section" @@ -7500,7 +7435,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN1413" +NAME="AEN1443" ></A >5.7.1. What to Edit</H2 ><P @@ -7615,7 +7550,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN1432" +NAME="AEN1462" ></A >5.7.2. How To Edit Templates</H2 ><P @@ -7697,7 +7632,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN1442" +NAME="AEN1472" ></A >5.7.3. Template Formats</H2 ><P @@ -7759,7 +7694,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN1455" +NAME="AEN1485" ></A >5.7.4. Particular Templates</H2 ><P @@ -8761,64 +8696,64 @@ HREF="#faq-general" ><DL ><DT >A.1.1. <A -HREF="#AEN1617" +HREF="#faq-general-information" > Where can I find information about Bugzilla?</A ></DT ><DT >A.1.2. <A -HREF="#AEN1623" +HREF="#faq-general-license" > What license is Bugzilla distributed under? </A ></DT ><DT >A.1.3. <A -HREF="#AEN1629" +HREF="#faq-general-support" > How do I get commercial support for Bugzilla? </A ></DT ><DT >A.1.4. <A -HREF="#AEN1638" +HREF="#faq-general-companies" > What major companies or projects are currently using Bugzilla for bug-tracking? </A ></DT ><DT >A.1.5. <A -HREF="#AEN1662" +HREF="#faq-general-maintainers" > Who maintains Bugzilla? </A ></DT ><DT >A.1.6. <A -HREF="#AEN1668" +HREF="#faq-general-compare" > How does Bugzilla stack up against other bug-tracking databases? </A ></DT ><DT >A.1.7. <A -HREF="#AEN1674" +HREF="#faq-general-bzmissing" > Why doesn't Bugzilla offer this or that feature or compatibility with this other tracking software? </A ></DT ><DT >A.1.8. <A -HREF="#AEN1681" +HREF="#faq-general-mysql" > Why MySQL? I'm interested in seeing Bugzilla run on Oracle/Sybase/Msql/PostgreSQL/MSSQL. </A ></DT ><DT >A.1.9. <A -HREF="#AEN1690" +HREF="#faq-general-bonsaitools" > Why do the scripts say "/usr/bonsaitools/bin/perl" instead of "/usr/bin/perl" or something else? </A ></DT ><DT >A.1.10. <A -HREF="#AEN1696" +HREF="#faq-general-cookie" > Is there an easy way to change the Bugzilla cookie name? </A ></DT @@ -8833,41 +8768,41 @@ HREF="#faq-phb" ><DL ><DT >A.2.1. <A -HREF="#AEN1706" +HREF="#faq-phb-client" > Is Bugzilla web-based, or do you have to have specific software or a specific operating system on your machine? </A ></DT ><DT >A.2.2. <A -HREF="#AEN1711" +HREF="#faq-phb-integration" > Can Bugzilla integrate with Perforce (SCM software)? </A ></DT ><DT >A.2.3. <A -HREF="#AEN1716" +HREF="#faq-phb-projects" > Does Bugzilla allow the user to track multiple projects? </A ></DT ><DT >A.2.4. <A -HREF="#AEN1721" +HREF="#faq-phb-sorting" > If I am on many projects, and search for all bugs assigned to me, will Bugzilla list them for me and allow me to sort by project, severity etc? </A ></DT ><DT >A.2.5. <A -HREF="#AEN1726" +HREF="#faq-phb-attachments" > Does Bugzilla allow attachments (text, screenshots, URLs etc)? If yes, are there any that are NOT allowed? </A ></DT ><DT >A.2.6. <A -HREF="#AEN1731" +HREF="#faq-phb-priorities" > Does Bugzilla allow us to define our own priorities and levels? Do we have complete freedom to change the labels of fields and format of them, and the choice of acceptable values? @@ -8875,35 +8810,35 @@ HREF="#AEN1731" ></DT ><DT >A.2.7. <A -HREF="#AEN1738" +HREF="#faq-phb-reporting" > Does Bugzilla provide any reporting features, metrics, graphs, etc? You know, the type of stuff that management likes to see. :) </A ></DT ><DT >A.2.8. <A -HREF="#AEN1745" +HREF="#faq-phb-email" > Is there email notification and if so, what do you see when you get an email? </A ></DT ><DT >A.2.9. <A -HREF="#AEN1750" +HREF="#faq-phb-cclist" > Can email notification be set up to send to multiple people, some on the To List, CC List, BCC List etc? </A ></DT ><DT >A.2.10. <A -HREF="#AEN1755" +HREF="#faq-phb-emailapp" > Do users have to have any particular type of email application? </A ></DT ><DT >A.2.11. <A -HREF="#AEN1762" +HREF="#faq-phb-data" > Does Bugzilla allow data to be imported and exported? If I had outsiders write up a bug report using a MS Word bug template, could that template be imported into "matching" fields? If I wanted to take the results of a query @@ -8912,28 +8847,28 @@ HREF="#AEN1762" ></DT ><DT >A.2.12. <A -HREF="#AEN1774" +HREF="#faq-phb-l10n" > Has anyone converted Bugzilla to another language to be used in other countries? Is it localizable? </A ></DT ><DT >A.2.13. <A -HREF="#AEN1781" +HREF="#faq-phb-reports" > Can a user create and save reports? Can they do this in Word format? Excel format? </A ></DT ><DT >A.2.14. <A -HREF="#AEN1786" +HREF="#faq-phb-searching" > Does Bugzilla have the ability to search by word, phrase, compound search? </A ></DT ><DT >A.2.15. <A -HREF="#AEN1791" +HREF="#faq-phb-midair" > Does Bugzilla provide record locking when there is simultaneous access to the same bug? Does the second person get a notice that the bug is in use or how are they notified? @@ -8941,19 +8876,19 @@ HREF="#AEN1791" ></DT ><DT >A.2.16. <A -HREF="#AEN1796" +HREF="#faq-phb-backup" > Are there any backup features provided? </A ></DT ><DT >A.2.17. <A -HREF="#AEN1802" +HREF="#faq-phb-livebackup" > Can users be on the system while a backup is in progress? </A ></DT ><DT >A.2.18. <A -HREF="#AEN1807" +HREF="#faq-phb-maintenance" > What type of human resources are needed to be on staff to install and maintain Bugzilla? Specifically, what type of skills does the person need to have? I need to find out if we were to go with Bugzilla, what types of @@ -8963,7 +8898,7 @@ HREF="#AEN1807" ></DT ><DT >A.2.19. <A -HREF="#AEN1813" +HREF="#faq-phb-installtime" > What time frame are we looking at if we decide to hire people to install and maintain the Bugzilla? Is this something that takes hours or weeks to install and a couple of hours per week to maintain and customize or is this @@ -8973,7 +8908,7 @@ HREF="#AEN1813" ></DT ><DT >A.2.20. <A -HREF="#AEN1818" +HREF="#faq-phb-cost" > Is there any licensing fee or other fees for using Bugzilla? Any out-of-pocket cost other than the bodies needed as identified above? </A @@ -8989,20 +8924,20 @@ HREF="#faq-security" ><DL ><DT >A.3.1. <A -HREF="#AEN1825" +HREF="#faq-security-mysql" > How do I completely disable MySQL security if it's giving me problems (I've followed the instructions in the installation section of this guide)? </A ></DT ><DT >A.3.2. <A -HREF="#AEN1831" +HREF="#faq-security-knownproblems" > Are there any security problems with Bugzilla? </A ></DT ><DT >A.3.3. <A -HREF="#AEN1836" +HREF="#faq-security-mysqluser" > I've implemented the security fixes mentioned in Chris Yeh's security advisory of 5/10/2000 advising not to run MySQL as root, and am running into problems with MySQL no longer working correctly. @@ -9019,48 +8954,48 @@ HREF="#faq-email" ><DL ><DT >A.4.1. <A -HREF="#AEN1843" +HREF="#faq-email-nomail" > I have a user who doesn't want to receive any more email from Bugzilla. How do I stop it entirely for this user? </A ></DT ><DT >A.4.2. <A -HREF="#AEN1849" +HREF="#faq-email-testing" > I'm evaluating/testing Bugzilla, and don't want it to send email to anyone but me. How do I do it? </A ></DT ><DT >A.4.3. <A -HREF="#AEN1854" +HREF="#faq-email-whine" > I want whineatnews.pl to whine at something more, or other than, only new bugs. How do I do it? </A ></DT ><DT >A.4.4. <A -HREF="#AEN1860" +HREF="#faq-email-procmail" > I don't like/want to use Procmail to hand mail off to bug_email.pl. What alternatives do I have? </A ></DT ><DT >A.4.5. <A -HREF="#AEN1867" +HREF="#faq-email-mailif" > How do I set up the email interface to submit/change bugs via email? </A ></DT ><DT >A.4.6. <A -HREF="#AEN1872" +HREF="#faq-email-sendmailnow" > Email takes FOREVER to reach me from Bugzilla -- it's extremely slow. What gives? </A ></DT ><DT >A.4.7. <A -HREF="#AEN1879" +HREF="#faq-email-nonreceived" > How come email from Bugzilla changes never reaches me? </A ></DT @@ -9075,33 +9010,33 @@ HREF="#faq-db" ><DL ><DT >A.5.1. <A -HREF="#AEN1887" +HREF="#faq-db-oracle" > I've heard Bugzilla can be used with Oracle? </A ></DT ><DT >A.5.2. <A -HREF="#AEN1892" +HREF="#faq-db-corrupted" > I think my database might be corrupted, or contain invalid entries. What do I do? </A ></DT ><DT >A.5.3. <A -HREF="#AEN1900" +HREF="#faq-db-manualedit" > I want to manually edit some entries in my database. How? </A ></DT ><DT >A.5.4. <A -HREF="#AEN1908" +HREF="#faq-db-permissions" > I think I've set up MySQL permissions correctly, but Bugzilla still can't connect. </A ></DT ><DT >A.5.5. <A -HREF="#AEN1916" +HREF="#faq-db-synchronize" > How do I synchronize bug information among multiple different Bugzilla databases? </A @@ -9117,26 +9052,26 @@ HREF="#faq-nt" ><DL ><DT >A.6.1. <A -HREF="#AEN1925" +HREF="#faq-nt-easiest" > What is the easiest way to run Bugzilla on Win32 (Win98+/NT/2K)? </A ></DT ><DT >A.6.2. <A -HREF="#AEN1930" +HREF="#faq-nt-bundle" > Is there a "Bundle::Bugzilla" equivalent for Win32? </A ></DT ><DT >A.6.3. <A -HREF="#AEN1935" +HREF="#faq-nt-mappings" > CGI's are failing with a "something.cgi is not a valid Windows NT application" error. Why? </A ></DT ><DT >A.6.4. <A -HREF="#AEN1943" +HREF="#faq-nt-dbi" > I'm having trouble with the perl modules for NT not being able to talk to to the database. </A @@ -9152,33 +9087,33 @@ HREF="#faq-use" ><DL ><DT >A.7.1. <A -HREF="#AEN1964" +HREF="#faq-use-changeaddress" > How do I change my user name (email address) in Bugzilla? </A ></DT ><DT >A.7.2. <A -HREF="#AEN1969" +HREF="#faq-use-query" > The query page is very confusing. Isn't there a simpler way to query? </A ></DT ><DT >A.7.3. <A -HREF="#AEN1974" +HREF="#faq-use-accept" > I'm confused by the behavior of the "accept" button in the Show Bug form. Why doesn't it assign the bug to me when I accept it? </A ></DT ><DT >A.7.4. <A -HREF="#AEN1984" +HREF="#faq-use-attachment" > I can't upload anything into the database via the "Create Attachment" link. What am I doing wrong? </A ></DT ><DT >A.7.5. <A -HREF="#AEN1989" +HREF="#faq-use-keyword" > How do I change a keyword in Bugzilla, once some bugs are using it? </A ></DT @@ -9193,26 +9128,26 @@ HREF="#faq-hacking" ><DL ><DT >A.8.1. <A -HREF="#AEN1996" +HREF="#faq-hacking-templatestyle" > What kind of style should I use for templatization? </A ></DT ><DT >A.8.2. <A -HREF="#AEN2004" +HREF="#faq-hacking-bugzillabugs" > What bugs are in Bugzilla right now? </A ></DT ><DT >A.8.3. <A -HREF="#AEN2013" +HREF="#faq-hacking-priority" > How can I change the default priority to a null value? For instance, have the default priority be "---" instead of "P2"? </A ></DT ><DT >A.8.4. <A -HREF="#AEN2019" +HREF="#faq-hacking-patches" > What's the best way to submit patches? What guidelines should I follow? </A ></DT @@ -9232,7 +9167,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1617" +NAME="faq-general-information" ></A ><B >A.1.1. </B @@ -9260,7 +9195,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1623" +NAME="faq-general-license" ></A ><B >A.1.2. </B @@ -9289,7 +9224,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1629" +NAME="faq-general-support" ></A ><B >A.1.3. </B @@ -9335,7 +9270,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1638" +NAME="faq-general-companies" ></A ><B >A.1.4. </B @@ -9441,7 +9376,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1662" +NAME="faq-general-maintainers" ></A ><B >A.1.5. </B @@ -9471,7 +9406,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1668" +NAME="faq-general-compare" ></A ><B >A.1.6. </B @@ -9509,7 +9444,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1674" +NAME="faq-general-bzmissing" ></A ><B >A.1.7. </B @@ -9549,7 +9484,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1681" +NAME="faq-general-mysql" ></A ><B >A.1.8. </B @@ -9594,7 +9529,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1690" +NAME="faq-general-bonsaitools" ></A ><B >A.1.9. </B @@ -9627,7 +9562,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1696" +NAME="faq-general-cookie" ></A ><B >A.1.10. </B @@ -9689,7 +9624,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1706" +NAME="faq-phb-client" ></A ><B >A.2.1. </B @@ -9715,7 +9650,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1711" +NAME="faq-phb-integration" ></A ><B >A.2.2. </B @@ -9741,7 +9676,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1716" +NAME="faq-phb-projects" ></A ><B >A.2.3. </B @@ -9766,7 +9701,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1721" +NAME="faq-phb-sorting" ></A ><B >A.2.4. </B @@ -9791,7 +9726,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1726" +NAME="faq-phb-attachments" ></A ><B >A.2.5. </B @@ -9820,7 +9755,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1731" +NAME="faq-phb-priorities" ></A ><B >A.2.6. </B @@ -9857,7 +9792,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1738" +NAME="faq-phb-reporting" ></A ><B >A.2.7. </B @@ -9895,7 +9830,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1745" +NAME="faq-phb-email" ></A ><B >A.2.8. </B @@ -9922,7 +9857,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1750" +NAME="faq-phb-cclist" ></A ><B >A.2.9. </B @@ -9947,7 +9882,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1755" +NAME="faq-phb-emailapp" ></A ><B >A.2.10. </B @@ -10006,7 +9941,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1762" +NAME="faq-phb-data" ></A ><B >A.2.11. </B @@ -10068,7 +10003,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1774" +NAME="faq-phb-l10n" ></A ><B >A.2.12. </B @@ -10106,7 +10041,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1781" +NAME="faq-phb-reports" ></A ><B >A.2.13. </B @@ -10131,7 +10066,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1786" +NAME="faq-phb-searching" ></A ><B >A.2.14. </B @@ -10157,7 +10092,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1791" +NAME="faq-phb-midair" ></A ><B >A.2.15. </B @@ -10184,7 +10119,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1796" +NAME="faq-phb-backup" ></A ><B >A.2.16. </B @@ -10214,7 +10149,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1802" +NAME="faq-phb-livebackup" ></A ><B >A.2.17. </B @@ -10240,7 +10175,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1807" +NAME="faq-phb-maintenance" ></A ><B >A.2.18. </B @@ -10275,7 +10210,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1813" +NAME="faq-phb-installtime" ></A ><B >A.2.19. </B @@ -10308,7 +10243,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1818" +NAME="faq-phb-cost" ></A ><B >A.2.20. </B @@ -10342,7 +10277,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1825" +NAME="faq-security-mysql" ></A ><B >A.3.1. </B @@ -10371,7 +10306,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1831" +NAME="faq-security-knownproblems" ></A ><B >A.3.2. </B @@ -10399,7 +10334,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1836" +NAME="faq-security-mysqluser" ></A ><B >A.3.3. </B @@ -10435,7 +10370,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1843" +NAME="faq-email-nomail" ></A ><B >A.4.1. </B @@ -10465,7 +10400,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1849" +NAME="faq-email-testing" ></A ><B >A.4.2. </B @@ -10491,7 +10426,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1854" +NAME="faq-email-whine" ></A ><B >A.4.3. </B @@ -10523,7 +10458,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1860" +NAME="faq-email-procmail" ></A ><B >A.4.4. </B @@ -10541,7 +10476,7 @@ CLASS="answer" You can call bug_email.pl directly from your aliases file, with an entry like this: <A -NAME="AEN1864" +NAME="AEN1894" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" @@ -10562,7 +10497,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1867" +NAME="faq-email-mailif" ></A ><B >A.4.5. </B @@ -10587,7 +10522,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1872" +NAME="faq-email-sendmailnow" ></A ><B >A.4.6. </B @@ -10602,17 +10537,43 @@ CLASS="answer" ><B > </B > - If you are using an alternate Mail Transport Agent (MTA other than - sendmail), make sure the options given in the "processmail" and other - scripts for all - instances of "sendmail" are correct for your MTA. + If you are using an alternate <A +HREF="#gloss-mta" +><I +CLASS="glossterm" +>MTA</I +></A +>, + make sure the options given in <TT +CLASS="filename" +>Bugzilla/BugMail.pm</TT +> + and any other place where <SPAN +CLASS="application" +>sendmail</SPAN +> is called from + are correct for your MTA. You should also ensure that the + <TT +CLASS="option" +>sendmailnow</TT +> param is set to <TT +CLASS="literal" +>on</TT +>. </P ><P -> If you are using Sendmail, try enabling "sendmailnow" in editparams.cgi. - If you are using Postfix, you will also need to enable <SPAN -CLASS="QUOTE" ->"sendmailnow"</SPAN +> If you are using <SPAN +CLASS="application" +>sendmail</SPAN +>, try enabling + <TT +CLASS="option" +>sendmailnow</TT +> in <TT +CLASS="filename" +>editparams.cgi</TT >. + </P ></DIV ></DIV @@ -10622,7 +10583,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1879" +NAME="faq-email-nonreceived" ></A ><B >A.4.7. </B @@ -10662,7 +10623,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1887" +NAME="faq-db-oracle" ></A ><B >A.5.1. </B @@ -10690,7 +10651,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1892" +NAME="faq-db-corrupted" ></A ><B >A.5.2. </B @@ -10737,7 +10698,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1900" +NAME="faq-db-manualedit" ></A ><B >A.5.3. </B @@ -10778,7 +10739,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1908" +NAME="faq-db-permissions" ></A ><B >A.5.4. </B @@ -10839,7 +10800,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1916" +NAME="faq-db-synchronize" ></A ><B >A.5.5. </B @@ -10885,7 +10846,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1925" +NAME="faq-nt-easiest" ></A ><B >A.6.1. </B @@ -10910,7 +10871,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1930" +NAME="faq-nt-bundle" ></A ><B >A.6.2. </B @@ -10936,7 +10897,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1935" +NAME="faq-nt-mappings" ></A ><B >A.6.3. </B @@ -10959,7 +10920,7 @@ CLASS="answer" ><P > Microsoft has some advice on this matter, as well: <A -NAME="AEN1940" +NAME="AEN1977" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" @@ -10984,7 +10945,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1943" +NAME="faq-nt-dbi" ></A ><B >A.6.4. </B @@ -11061,7 +11022,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1964" +NAME="faq-use-changeaddress" ></A ><B >A.7.1. </B @@ -11086,7 +11047,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1969" +NAME="faq-use-query" ></A ><B >A.7.2. </B @@ -11112,7 +11073,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1974" +NAME="faq-use-accept" ></A ><B >A.7.3. </B @@ -11167,7 +11128,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1984" +NAME="faq-use-attachment" ></A ><B >A.7.4. </B @@ -11194,7 +11155,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1989" +NAME="faq-use-keyword" ></A ><B >A.7.5. </B @@ -11228,7 +11189,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1996" +NAME="faq-hacking-templatestyle" ></A ><B >A.8.1. </B @@ -11287,7 +11248,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN2004" +NAME="faq-hacking-bugzillabugs" ></A ><B >A.8.2. </B @@ -11333,7 +11294,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN2013" +NAME="faq-hacking-priority" ></A ><B >A.8.3. </B @@ -11365,7 +11326,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN2019" +NAME="faq-hacking-patches" ></A ><B >A.8.4. </B @@ -11589,7 +11550,7 @@ CLASS="section" ><HR><H2 CLASS="section" ><A -NAME="AEN2062" +NAME="AEN2099" ></A >B.2.1. Bugzilla Database Basics</H2 ><P @@ -11705,7 +11666,7 @@ CLASS="section" ><HR><H3 CLASS="section" ><A -NAME="AEN2089" +NAME="AEN2126" ></A >B.2.1.1. Bugzilla Database Tables</H3 ><P @@ -12125,7 +12086,7 @@ CLASS="section" ><HR><H1 CLASS="section" ><A -NAME="rhbugzilla" +NAME="variant-redhat" ></A >D.1. Red Hat Bugzilla</H1 ><P @@ -12185,7 +12146,7 @@ NAME="variant-issuezilla" at tigris.org is their Java-based bug-tracker, <A HREF="#variant-scarab" ->Scarab</A +>Section D.4</A >.</P ><P >This section last updated 27 Jul 2002</P @@ -12273,7 +12234,7 @@ NAME="gfdl" ><P >Version 1.1, March 2000</P ><A -NAME="AEN2177" +NAME="AEN2214" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" @@ -12738,7 +12699,7 @@ NAME="gfdl-howto" of the License in the document and put the following copyright and license notices just after the title page:</P ><A -NAME="AEN2267" +NAME="AEN2304" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" @@ -12775,7 +12736,7 @@ CLASS="glossdiv" ><H1 CLASS="glossdiv" ><A -NAME="AEN2272" +NAME="AEN2309" ></A >0-9, high ascii</H1 ><DL @@ -13190,21 +13151,78 @@ NAME="gloss-m" >M</H1 ><DL ><DT +><A +NAME="gloss-mta" +></A ><B ->mysqld</B +>Message Transport Agent</B +></DT +> (MTA)<DD +><P +>A Message Transport Agent is used to control the flow of email + on a system. Many unix based systems use + <A +HREF="http://www.sendmail.org" +TARGET="_top" +>sendmail</A +> which is what + Bugzilla expects to find by default at <TT +CLASS="filename" +>/usr/sbin/sendmail</TT +>. + Many other MTA's will work, but they all require that the + <TT +CLASS="option" +>sendmailnow</TT +> param be set to <TT +CLASS="literal" +>on</TT +>. + </P +></DD +><DT +><A +NAME="gloss-mysql" +></A +><B +>MySQL</B ></DT ><DD ><P ->mysqld is the name of the - <I +>MySQL is currently the required + <A +HREF="#gloss-rdbms" +><I CLASS="glossterm" ->daemon</I -> - - for the MySQL database. In general, it is invoked automatically - through the use of the System V init scripts on GNU/Linux and - AT&T System V-based systems, such as Solaris and HP/UX, or - through the RC scripts on BSD-based systems.</P +>RDBMS</I +></A +> for Bugzilla. MySQL + can be downloaded from <A +HREF="http://www.mysql.com" +TARGET="_top" +>http://www.mysql.com</A +>. While you + should familiarize yourself with all of the documentation, some high + points are: + </P +><P +></P +><UL +><LI +><P +><A +HREF="http://www.mysql.com/doc/P/r/Privilege_system.html" +TARGET="_top" +>MySQL + Privilege System</A +> - Much more detailed information about + the suggestions in <A +HREF="#security-mysql" +>Section 5.6.2</A +>. + </P +></LI +></UL ></DD ></DL ></DIV @@ -13298,6 +13316,30 @@ CLASS="glossdiv" ><H1 CLASS="glossdiv" ><A +NAME="gloss-r" +></A +>R</H1 +><DL +><DT +><A +NAME="gloss-rdbms" +></A +><B +>Relational DataBase Managment System</B +></DT +> (RDBMS)<DD +><P +>A relational database management system is a database system + that stores information in tables that are related to each other. + </P +></DD +></DL +></DIV +><DIV +CLASS="glossdiv" +><H1 +CLASS="glossdiv" +><A NAME="gloss-s" ></A >S</H1 diff --git a/docs/html/about.html b/docs/html/about.html index 409d35b68..ce7d43191 100644 --- a/docs/html/about.html +++ b/docs/html/about.html @@ -7,10 +7,10 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="NEXT" TITLE="Copyright Information" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -151,7 +151,7 @@ ACCESSKEY="N" WIDTH="33%" ALIGN="left" VALIGN="top" ->The Bugzilla Guide</TD +>The Bugzilla Guide - 2.17.4 Development Release</TD ><TD WIDTH="34%" ALIGN="center" diff --git a/docs/html/administration.html b/docs/html/administration.html index 2cf3c373b..c505edaeb 100644 --- a/docs/html/administration.html +++ b/docs/html/administration.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="Troubleshooting" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -147,6 +147,30 @@ HREF="groups.html" HREF="security.html" >Bugzilla Security</A ></DT +><DD +><DL +><DT +>5.6.1. <A +HREF="security.html#security-networking" +>TCP/IP Ports</A +></DT +><DT +>5.6.2. <A +HREF="security.html#security-mysql" +>MySQL</A +></DT +><DT +>5.6.3. <A +HREF="security.html#security-daemon" +>Daemon Accounts</A +></DT +><DT +>5.6.4. <A +HREF="security.html#security-access" +>Web Server Access Controls</A +></DT +></DL +></DD ><DT >5.7. <A HREF="cust-templates.html" @@ -156,22 +180,22 @@ HREF="cust-templates.html" ><DL ><DT >5.7.1. <A -HREF="cust-templates.html#AEN1413" +HREF="cust-templates.html#AEN1443" >What to Edit</A ></DT ><DT >5.7.2. <A -HREF="cust-templates.html#AEN1432" +HREF="cust-templates.html#AEN1462" >How To Edit Templates</A ></DT ><DT >5.7.3. <A -HREF="cust-templates.html#AEN1442" +HREF="cust-templates.html#AEN1472" >Template Formats</A ></DT ><DT >5.7.4. <A -HREF="cust-templates.html#AEN1455" +HREF="cust-templates.html#AEN1485" >Particular Templates</A ></DT ></DL diff --git a/docs/html/cmdline.html b/docs/html/cmdline.html index d474b88ff..200304fe8 100644 --- a/docs/html/cmdline.html +++ b/docs/html/cmdline.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Useful Patches and Utilities for Bugzilla" @@ -40,7 +40,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/conventions.html b/docs/html/conventions.html index dba8eeec7..6964b1df6 100644 --- a/docs/html/conventions.html +++ b/docs/html/conventions.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="About This Guide" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -81,7 +81,7 @@ NAME="conventions" ><DIV CLASS="informaltable" ><A -NAME="AEN80" +NAME="AEN110" ></A ><P ></P diff --git a/docs/html/copyright.html b/docs/html/copyright.html index 259332335..83b9d7bd9 100644 --- a/docs/html/copyright.html +++ b/docs/html/copyright.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="About This Guide" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -77,7 +77,7 @@ NAME="copyright" ></A >1.1. Copyright Information</H1 ><A -NAME="AEN34" +NAME="AEN33" ></A ><TABLE BORDER="0" diff --git a/docs/html/credits.html b/docs/html/credits.html index b609c9c7d..ff4603d0d 100644 --- a/docs/html/credits.html +++ b/docs/html/credits.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="About This Guide" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -83,66 +83,115 @@ NAME="credits" contribution to the Bugzilla community: </P ><P -> <A -HREF="mailto://mbarnson@sisna.com" -TARGET="_top" ->Matthew P. Barnson</A -> - for the Herculaean task of pulling together the Bugzilla Guide and - shepherding it to 2.14. - </P +></P +><DIV +CLASS="variablelist" +><DL +><DT +>Matthew P. Barnson <TT +CLASS="email" +><<A +HREF="mailto:mbarnson@sisna.com" +>mbarnson@sisna.com</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://terry@mozilla.org" -TARGET="_top" ->Terry Weissman</A -> - for initially writing Bugzilla and creating the - README upon which the UNIX installation documentation is largely based. - </P +>for the Herculaean task of pulling together the Bugzilla Guide + and shepherding it to 2.14. + </P +></DD +><DT +>Terry Weissman <TT +CLASS="email" +><<A +HREF="mailto:terry@mozilla.org" +>terry@mozilla.org</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://tara@tequilarista.org" -TARGET="_top" ->Tara Hernandez</A -> - for keeping Bugzilla development going - strong after Terry left mozilla.org - </P +>for initially writing Bugzilla and creating the README upon + which the UNIX installation documentation is largely based. + </P +></DD +><DT +>Tara Hernandez <TT +CLASS="email" +><<A +HREF="mailto:tara@tequilarists.org" +>tara@tequilarists.org</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://dkl@redhat.com" -TARGET="_top" ->Dave Lawrence</A -> - for providing insight into the key differences between Red Hat's - customized Bugzilla, and being largely responsible for the "Red - Hat Bugzilla" appendix - </P +>for keeping Bugzilla development going strong after Terry left + mozilla.org and for running landfill. + </P +></DD +><DT +>Dave Lawrence <TT +CLASS="email" +><<A +HREF="mailto:dkl@redhat.com" +>dkl@redhat.com</A +>></TT +></DT +><DD ><P -> <A -HREF="mailto://endico@mozilla.org" -TARGET="_top" ->Dawn Endico</A -> for - being a hacker extraordinaire and putting up with my incessant - questions and arguments on irc.mozilla.org in #mozwebtools - </P +>for providing insight into the key differences between Red + Hat's customized Bugzilla, and being largely responsible for + <A +HREF="variant-redhat.html" +>Section D.1</A +>. + </P +></DD +><DT +>Dawn Endico <TT +CLASS="email" +><<A +HREF="mailto:endico@mozilla.org" +>endico@mozilla.org</A +>></TT +></DT +><DD +><P +>for being a hacker extraordinaire and putting up with Matthew's + incessant questions and arguments on irc.mozilla.org in #mozwebtools + </P +></DD +><DT +>Jacob Steenhagen <TT +CLASS="email" +><<A +HREF="mailto:jake@bugzilla.org" +>jake@bugzilla.org</A +>></TT +></DT +><DD +><P +>for taking over documentation during the 2.17 development + period. + </P +></DD +></DL +></DIV ><P > Last but not least, all the members of the <A HREF="news://news.mozilla.org/netscape/public/mozilla/webtools" TARGET="_top" -> netscape.public.mozilla.webtools</A -> newsgroup. Without your discussions, insight, suggestions, and patches, this could never have happened. +>news://news.mozilla.org/netscape/public/mozilla/webtools</A +> + newsgroup. Without your discussions, insight, suggestions, and patches, + this could never have happened. </P ><P > Thanks also go to the following people for significant contributions - to this documentation (in no particular order): - </P -><P -> Zach Liption, Andrew Pearson, Spencer Smith, Eric Hanson, Kevin Brannen, - Ron Teitelbaum, Jacob Steenhagen, Joe Robins, Gervase Markham. + to this documentation (in alphabetical order): + Andrew Pearson, Ben FrantzDale, Eric Hanson, Gervase Markham, Joe Robins, Kevin Brannen, Ron Teitelbaum, Spencer Smith, Zach Liption + . </P ></DIV ><DIV diff --git a/docs/html/cust-change-permissions.html b/docs/html/cust-change-permissions.html index a0981ea5a..465896d0b 100644 --- a/docs/html/cust-change-permissions.html +++ b/docs/html/cust-change-permissions.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/cust-templates.html b/docs/html/cust-templates.html index c790954f3..a7e333030 100644 --- a/docs/html/cust-templates.html +++ b/docs/html/cust-templates.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -99,7 +99,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN1413" +NAME="AEN1443" ></A >5.7.1. What to Edit</H2 ><P @@ -214,7 +214,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN1432" +NAME="AEN1462" ></A >5.7.2. How To Edit Templates</H2 ><P @@ -296,7 +296,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN1442" +NAME="AEN1472" ></A >5.7.3. Template Formats</H2 ><P @@ -358,7 +358,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN1455" +NAME="AEN1485" ></A >5.7.4. Particular Templates</H2 ><P diff --git a/docs/html/database.html b/docs/html/database.html index 234414939..dbb8b9fa4 100644 --- a/docs/html/database.html +++ b/docs/html/database.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="The Bugzilla FAQ" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/dbdoc.html b/docs/html/dbdoc.html index c7346a91a..830bb0ee2 100644 --- a/docs/html/dbdoc.html +++ b/docs/html/dbdoc.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="The Bugzilla Database" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -135,7 +135,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN2062" +NAME="AEN2099" ></A >B.2.1. Bugzilla Database Basics</H2 ><P @@ -251,7 +251,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN2089" +NAME="AEN2126" ></A >B.2.1.1. Bugzilla Database Tables</H3 ><P diff --git a/docs/html/dbmodify.html b/docs/html/dbmodify.html index 6b7d3ea5d..835cf0b4c 100644 --- a/docs/html/dbmodify.html +++ b/docs/html/dbmodify.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="The Bugzilla Database" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/disclaimer.html b/docs/html/disclaimer.html index 1140de957..ce2420afa 100644 --- a/docs/html/disclaimer.html +++ b/docs/html/disclaimer.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="About This Guide" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/extraconfig.html b/docs/html/extraconfig.html index f9d1f97aa..6699ba2cd 100644 --- a/docs/html/extraconfig.html +++ b/docs/html/extraconfig.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Installation" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -81,7 +81,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN755" +NAME="AEN719" ></A >4.2.1. Dependency Charts</H2 ><P @@ -145,7 +145,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN770" +NAME="AEN734" ></A >4.2.2. Bug Graphs</H2 ><P @@ -204,7 +204,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN783" +NAME="AEN747" ></A >4.2.3. The Whining Cron</H2 ><P @@ -542,181 +542,9 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="htaccess" -></A ->4.2.6. <TT -CLASS="filename" ->.htaccess</TT -> - files and security</H2 -><P ->To enhance the security of your Bugzilla installation, Bugzilla's - <TT -CLASS="filename" ->checksetup.pl</TT -> script will generate - <I -CLASS="glossterm" -> <TT -CLASS="filename" ->.htaccess</TT -> - </I -> - - files which the Apache webserver can use to restrict access to the - bugzilla data files. - These .htaccess files will not work with Apache 1.2.x - but this - has security holes, so you shouldn't be using it anyway. - <DIV -CLASS="note" -><P -></P -><TABLE -CLASS="note" -WIDTH="100%" -BORDER="0" -><TR -><TD -WIDTH="25" -ALIGN="CENTER" -VALIGN="TOP" -><IMG -SRC="../images/note.gif" -HSPACE="5" -ALT="Note"></TD -><TD -ALIGN="LEFT" -VALIGN="TOP" -><P ->If you are using an alternate provider of - <SPAN -CLASS="productname" ->webdot</SPAN -> - - services for graphing (as described when viewing - <TT -CLASS="filename" ->editparams.cgi</TT -> - - in your web browser), you will need to change the ip address in - <TT -CLASS="filename" ->data/webdot/.htaccess</TT -> - - to the ip address of the webdot server that you are using.</P -></TD -></TR -></TABLE -></DIV -> - </P -><P ->The default .htaccess file may not provide adequate access - restrictions, depending on your web server configuration. Be sure to - check the <Directory> entries for your Bugzilla directory so that - the - <TT -CLASS="filename" ->.htaccess</TT -> - - file is allowed to override web server defaults. For instance, let's - assume your installation of Bugzilla is installed to - <TT -CLASS="filename" ->/usr/local/bugzilla</TT -> - - . You should have this <Directory> entry in your - <TT -CLASS="filename" ->httpd.conf</TT -> - - file:</P -><P -> -<TABLE -BORDER="0" -BGCOLOR="#E0E0E0" -WIDTH="100%" -><TR -><TD -><FONT -COLOR="#000000" -><PRE -CLASS="programlisting" -> <Directory /usr/local/bugzilla/> - Options +FollowSymLinks +Indexes +Includes +ExecCGI - AllowOverride All -</Directory> -</PRE -></FONT -></TD -></TR -></TABLE -> - - </P -><P ->The important part above is - <SPAN -CLASS="QUOTE" ->"AllowOverride All"</SPAN -> - - . Without that, the - <TT -CLASS="filename" ->.htaccess</TT -> - - file created by - <TT -CLASS="filename" ->checksetup.pl</TT -> - - will not have sufficient permissions to protect your Bugzilla - installation.</P -><P ->If you are using Internet Information Server (IIS) or another - web server which does not observe - <TT -CLASS="filename" ->.htaccess</TT -> - conventions, you can disable their creation by editing - <TT -CLASS="filename" ->localconfig</TT -> - and setting the - <TT -CLASS="varname" ->$create_htaccess</TT -> - variable to - <TT -CLASS="parameter" -><I ->0</I -></TT ->. - </P -></DIV -><DIV -CLASS="section" -><H2 -CLASS="section" -><A NAME="directoryindex" ></A ->4.2.7. <TT +>4.2.6. <TT CLASS="filename" >directoryindex</TT > for the Bugzilla default page.</H2 @@ -743,7 +571,7 @@ CLASS="section" ><A NAME="mod_perl" ></A ->4.2.8. Bugzilla and <TT +>4.2.7. Bugzilla and <TT CLASS="filename" >mod_perl</TT ></H2 @@ -760,7 +588,7 @@ CLASS="section" ><A NAME="mod-throttle" ></A ->4.2.9. <TT +>4.2.8. <TT CLASS="filename" >mod_throttle</TT > diff --git a/docs/html/faq.html b/docs/html/faq.html index 920e17a58..606519724 100644 --- a/docs/html/faq.html +++ b/docs/html/faq.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="Integrating Bugzilla with Third-Party Tools" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -87,64 +87,64 @@ HREF="faq.html#faq-general" ><DL ><DT >A.1.1. <A -HREF="faq.html#AEN1617" +HREF="faq.html#faq-general-information" > Where can I find information about Bugzilla?</A ></DT ><DT >A.1.2. <A -HREF="faq.html#AEN1623" +HREF="faq.html#faq-general-license" > What license is Bugzilla distributed under? </A ></DT ><DT >A.1.3. <A -HREF="faq.html#AEN1629" +HREF="faq.html#faq-general-support" > How do I get commercial support for Bugzilla? </A ></DT ><DT >A.1.4. <A -HREF="faq.html#AEN1638" +HREF="faq.html#faq-general-companies" > What major companies or projects are currently using Bugzilla for bug-tracking? </A ></DT ><DT >A.1.5. <A -HREF="faq.html#AEN1662" +HREF="faq.html#faq-general-maintainers" > Who maintains Bugzilla? </A ></DT ><DT >A.1.6. <A -HREF="faq.html#AEN1668" +HREF="faq.html#faq-general-compare" > How does Bugzilla stack up against other bug-tracking databases? </A ></DT ><DT >A.1.7. <A -HREF="faq.html#AEN1674" +HREF="faq.html#faq-general-bzmissing" > Why doesn't Bugzilla offer this or that feature or compatibility with this other tracking software? </A ></DT ><DT >A.1.8. <A -HREF="faq.html#AEN1681" +HREF="faq.html#faq-general-mysql" > Why MySQL? I'm interested in seeing Bugzilla run on Oracle/Sybase/Msql/PostgreSQL/MSSQL. </A ></DT ><DT >A.1.9. <A -HREF="faq.html#AEN1690" +HREF="faq.html#faq-general-bonsaitools" > Why do the scripts say "/usr/bonsaitools/bin/perl" instead of "/usr/bin/perl" or something else? </A ></DT ><DT >A.1.10. <A -HREF="faq.html#AEN1696" +HREF="faq.html#faq-general-cookie" > Is there an easy way to change the Bugzilla cookie name? </A ></DT @@ -159,41 +159,41 @@ HREF="faq.html#faq-phb" ><DL ><DT >A.2.1. <A -HREF="faq.html#AEN1706" +HREF="faq.html#faq-phb-client" > Is Bugzilla web-based, or do you have to have specific software or a specific operating system on your machine? </A ></DT ><DT >A.2.2. <A -HREF="faq.html#AEN1711" +HREF="faq.html#faq-phb-integration" > Can Bugzilla integrate with Perforce (SCM software)? </A ></DT ><DT >A.2.3. <A -HREF="faq.html#AEN1716" +HREF="faq.html#faq-phb-projects" > Does Bugzilla allow the user to track multiple projects? </A ></DT ><DT >A.2.4. <A -HREF="faq.html#AEN1721" +HREF="faq.html#faq-phb-sorting" > If I am on many projects, and search for all bugs assigned to me, will Bugzilla list them for me and allow me to sort by project, severity etc? </A ></DT ><DT >A.2.5. <A -HREF="faq.html#AEN1726" +HREF="faq.html#faq-phb-attachments" > Does Bugzilla allow attachments (text, screenshots, URLs etc)? If yes, are there any that are NOT allowed? </A ></DT ><DT >A.2.6. <A -HREF="faq.html#AEN1731" +HREF="faq.html#faq-phb-priorities" > Does Bugzilla allow us to define our own priorities and levels? Do we have complete freedom to change the labels of fields and format of them, and the choice of acceptable values? @@ -201,35 +201,35 @@ HREF="faq.html#AEN1731" ></DT ><DT >A.2.7. <A -HREF="faq.html#AEN1738" +HREF="faq.html#faq-phb-reporting" > Does Bugzilla provide any reporting features, metrics, graphs, etc? You know, the type of stuff that management likes to see. :) </A ></DT ><DT >A.2.8. <A -HREF="faq.html#AEN1745" +HREF="faq.html#faq-phb-email" > Is there email notification and if so, what do you see when you get an email? </A ></DT ><DT >A.2.9. <A -HREF="faq.html#AEN1750" +HREF="faq.html#faq-phb-cclist" > Can email notification be set up to send to multiple people, some on the To List, CC List, BCC List etc? </A ></DT ><DT >A.2.10. <A -HREF="faq.html#AEN1755" +HREF="faq.html#faq-phb-emailapp" > Do users have to have any particular type of email application? </A ></DT ><DT >A.2.11. <A -HREF="faq.html#AEN1762" +HREF="faq.html#faq-phb-data" > Does Bugzilla allow data to be imported and exported? If I had outsiders write up a bug report using a MS Word bug template, could that template be imported into "matching" fields? If I wanted to take the results of a query @@ -238,28 +238,28 @@ HREF="faq.html#AEN1762" ></DT ><DT >A.2.12. <A -HREF="faq.html#AEN1774" +HREF="faq.html#faq-phb-l10n" > Has anyone converted Bugzilla to another language to be used in other countries? Is it localizable? </A ></DT ><DT >A.2.13. <A -HREF="faq.html#AEN1781" +HREF="faq.html#faq-phb-reports" > Can a user create and save reports? Can they do this in Word format? Excel format? </A ></DT ><DT >A.2.14. <A -HREF="faq.html#AEN1786" +HREF="faq.html#faq-phb-searching" > Does Bugzilla have the ability to search by word, phrase, compound search? </A ></DT ><DT >A.2.15. <A -HREF="faq.html#AEN1791" +HREF="faq.html#faq-phb-midair" > Does Bugzilla provide record locking when there is simultaneous access to the same bug? Does the second person get a notice that the bug is in use or how are they notified? @@ -267,19 +267,19 @@ HREF="faq.html#AEN1791" ></DT ><DT >A.2.16. <A -HREF="faq.html#AEN1796" +HREF="faq.html#faq-phb-backup" > Are there any backup features provided? </A ></DT ><DT >A.2.17. <A -HREF="faq.html#AEN1802" +HREF="faq.html#faq-phb-livebackup" > Can users be on the system while a backup is in progress? </A ></DT ><DT >A.2.18. <A -HREF="faq.html#AEN1807" +HREF="faq.html#faq-phb-maintenance" > What type of human resources are needed to be on staff to install and maintain Bugzilla? Specifically, what type of skills does the person need to have? I need to find out if we were to go with Bugzilla, what types of @@ -289,7 +289,7 @@ HREF="faq.html#AEN1807" ></DT ><DT >A.2.19. <A -HREF="faq.html#AEN1813" +HREF="faq.html#faq-phb-installtime" > What time frame are we looking at if we decide to hire people to install and maintain the Bugzilla? Is this something that takes hours or weeks to install and a couple of hours per week to maintain and customize or is this @@ -299,7 +299,7 @@ HREF="faq.html#AEN1813" ></DT ><DT >A.2.20. <A -HREF="faq.html#AEN1818" +HREF="faq.html#faq-phb-cost" > Is there any licensing fee or other fees for using Bugzilla? Any out-of-pocket cost other than the bodies needed as identified above? </A @@ -315,20 +315,20 @@ HREF="faq.html#faq-security" ><DL ><DT >A.3.1. <A -HREF="faq.html#AEN1825" +HREF="faq.html#faq-security-mysql" > How do I completely disable MySQL security if it's giving me problems (I've followed the instructions in the installation section of this guide)? </A ></DT ><DT >A.3.2. <A -HREF="faq.html#AEN1831" +HREF="faq.html#faq-security-knownproblems" > Are there any security problems with Bugzilla? </A ></DT ><DT >A.3.3. <A -HREF="faq.html#AEN1836" +HREF="faq.html#faq-security-mysqluser" > I've implemented the security fixes mentioned in Chris Yeh's security advisory of 5/10/2000 advising not to run MySQL as root, and am running into problems with MySQL no longer working correctly. @@ -345,48 +345,48 @@ HREF="faq.html#faq-email" ><DL ><DT >A.4.1. <A -HREF="faq.html#AEN1843" +HREF="faq.html#faq-email-nomail" > I have a user who doesn't want to receive any more email from Bugzilla. How do I stop it entirely for this user? </A ></DT ><DT >A.4.2. <A -HREF="faq.html#AEN1849" +HREF="faq.html#faq-email-testing" > I'm evaluating/testing Bugzilla, and don't want it to send email to anyone but me. How do I do it? </A ></DT ><DT >A.4.3. <A -HREF="faq.html#AEN1854" +HREF="faq.html#faq-email-whine" > I want whineatnews.pl to whine at something more, or other than, only new bugs. How do I do it? </A ></DT ><DT >A.4.4. <A -HREF="faq.html#AEN1860" +HREF="faq.html#faq-email-procmail" > I don't like/want to use Procmail to hand mail off to bug_email.pl. What alternatives do I have? </A ></DT ><DT >A.4.5. <A -HREF="faq.html#AEN1867" +HREF="faq.html#faq-email-mailif" > How do I set up the email interface to submit/change bugs via email? </A ></DT ><DT >A.4.6. <A -HREF="faq.html#AEN1872" +HREF="faq.html#faq-email-sendmailnow" > Email takes FOREVER to reach me from Bugzilla -- it's extremely slow. What gives? </A ></DT ><DT >A.4.7. <A -HREF="faq.html#AEN1879" +HREF="faq.html#faq-email-nonreceived" > How come email from Bugzilla changes never reaches me? </A ></DT @@ -401,33 +401,33 @@ HREF="faq.html#faq-db" ><DL ><DT >A.5.1. <A -HREF="faq.html#AEN1887" +HREF="faq.html#faq-db-oracle" > I've heard Bugzilla can be used with Oracle? </A ></DT ><DT >A.5.2. <A -HREF="faq.html#AEN1892" +HREF="faq.html#faq-db-corrupted" > I think my database might be corrupted, or contain invalid entries. What do I do? </A ></DT ><DT >A.5.3. <A -HREF="faq.html#AEN1900" +HREF="faq.html#faq-db-manualedit" > I want to manually edit some entries in my database. How? </A ></DT ><DT >A.5.4. <A -HREF="faq.html#AEN1908" +HREF="faq.html#faq-db-permissions" > I think I've set up MySQL permissions correctly, but Bugzilla still can't connect. </A ></DT ><DT >A.5.5. <A -HREF="faq.html#AEN1916" +HREF="faq.html#faq-db-synchronize" > How do I synchronize bug information among multiple different Bugzilla databases? </A @@ -443,26 +443,26 @@ HREF="faq.html#faq-nt" ><DL ><DT >A.6.1. <A -HREF="faq.html#AEN1925" +HREF="faq.html#faq-nt-easiest" > What is the easiest way to run Bugzilla on Win32 (Win98+/NT/2K)? </A ></DT ><DT >A.6.2. <A -HREF="faq.html#AEN1930" +HREF="faq.html#faq-nt-bundle" > Is there a "Bundle::Bugzilla" equivalent for Win32? </A ></DT ><DT >A.6.3. <A -HREF="faq.html#AEN1935" +HREF="faq.html#faq-nt-mappings" > CGI's are failing with a "something.cgi is not a valid Windows NT application" error. Why? </A ></DT ><DT >A.6.4. <A -HREF="faq.html#AEN1943" +HREF="faq.html#faq-nt-dbi" > I'm having trouble with the perl modules for NT not being able to talk to to the database. </A @@ -478,33 +478,33 @@ HREF="faq.html#faq-use" ><DL ><DT >A.7.1. <A -HREF="faq.html#AEN1964" +HREF="faq.html#faq-use-changeaddress" > How do I change my user name (email address) in Bugzilla? </A ></DT ><DT >A.7.2. <A -HREF="faq.html#AEN1969" +HREF="faq.html#faq-use-query" > The query page is very confusing. Isn't there a simpler way to query? </A ></DT ><DT >A.7.3. <A -HREF="faq.html#AEN1974" +HREF="faq.html#faq-use-accept" > I'm confused by the behavior of the "accept" button in the Show Bug form. Why doesn't it assign the bug to me when I accept it? </A ></DT ><DT >A.7.4. <A -HREF="faq.html#AEN1984" +HREF="faq.html#faq-use-attachment" > I can't upload anything into the database via the "Create Attachment" link. What am I doing wrong? </A ></DT ><DT >A.7.5. <A -HREF="faq.html#AEN1989" +HREF="faq.html#faq-use-keyword" > How do I change a keyword in Bugzilla, once some bugs are using it? </A ></DT @@ -519,26 +519,26 @@ HREF="faq.html#faq-hacking" ><DL ><DT >A.8.1. <A -HREF="faq.html#AEN1996" +HREF="faq.html#faq-hacking-templatestyle" > What kind of style should I use for templatization? </A ></DT ><DT >A.8.2. <A -HREF="faq.html#AEN2004" +HREF="faq.html#faq-hacking-bugzillabugs" > What bugs are in Bugzilla right now? </A ></DT ><DT >A.8.3. <A -HREF="faq.html#AEN2013" +HREF="faq.html#faq-hacking-priority" > How can I change the default priority to a null value? For instance, have the default priority be "---" instead of "P2"? </A ></DT ><DT >A.8.4. <A -HREF="faq.html#AEN2019" +HREF="faq.html#faq-hacking-patches" > What's the best way to submit patches? What guidelines should I follow? </A ></DT @@ -558,7 +558,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1617" +NAME="faq-general-information" ></A ><B >A.1.1. </B @@ -586,7 +586,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1623" +NAME="faq-general-license" ></A ><B >A.1.2. </B @@ -615,7 +615,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1629" +NAME="faq-general-support" ></A ><B >A.1.3. </B @@ -661,7 +661,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1638" +NAME="faq-general-companies" ></A ><B >A.1.4. </B @@ -767,7 +767,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1662" +NAME="faq-general-maintainers" ></A ><B >A.1.5. </B @@ -797,7 +797,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1668" +NAME="faq-general-compare" ></A ><B >A.1.6. </B @@ -835,7 +835,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1674" +NAME="faq-general-bzmissing" ></A ><B >A.1.7. </B @@ -875,7 +875,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1681" +NAME="faq-general-mysql" ></A ><B >A.1.8. </B @@ -920,7 +920,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1690" +NAME="faq-general-bonsaitools" ></A ><B >A.1.9. </B @@ -953,7 +953,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1696" +NAME="faq-general-cookie" ></A ><B >A.1.10. </B @@ -1015,7 +1015,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1706" +NAME="faq-phb-client" ></A ><B >A.2.1. </B @@ -1041,7 +1041,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1711" +NAME="faq-phb-integration" ></A ><B >A.2.2. </B @@ -1067,7 +1067,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1716" +NAME="faq-phb-projects" ></A ><B >A.2.3. </B @@ -1092,7 +1092,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1721" +NAME="faq-phb-sorting" ></A ><B >A.2.4. </B @@ -1117,7 +1117,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1726" +NAME="faq-phb-attachments" ></A ><B >A.2.5. </B @@ -1146,7 +1146,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1731" +NAME="faq-phb-priorities" ></A ><B >A.2.6. </B @@ -1183,7 +1183,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1738" +NAME="faq-phb-reporting" ></A ><B >A.2.7. </B @@ -1221,7 +1221,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1745" +NAME="faq-phb-email" ></A ><B >A.2.8. </B @@ -1248,7 +1248,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1750" +NAME="faq-phb-cclist" ></A ><B >A.2.9. </B @@ -1273,7 +1273,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1755" +NAME="faq-phb-emailapp" ></A ><B >A.2.10. </B @@ -1332,7 +1332,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1762" +NAME="faq-phb-data" ></A ><B >A.2.11. </B @@ -1394,7 +1394,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1774" +NAME="faq-phb-l10n" ></A ><B >A.2.12. </B @@ -1432,7 +1432,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1781" +NAME="faq-phb-reports" ></A ><B >A.2.13. </B @@ -1457,7 +1457,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1786" +NAME="faq-phb-searching" ></A ><B >A.2.14. </B @@ -1483,7 +1483,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1791" +NAME="faq-phb-midair" ></A ><B >A.2.15. </B @@ -1510,7 +1510,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1796" +NAME="faq-phb-backup" ></A ><B >A.2.16. </B @@ -1540,7 +1540,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1802" +NAME="faq-phb-livebackup" ></A ><B >A.2.17. </B @@ -1566,7 +1566,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1807" +NAME="faq-phb-maintenance" ></A ><B >A.2.18. </B @@ -1601,7 +1601,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1813" +NAME="faq-phb-installtime" ></A ><B >A.2.19. </B @@ -1634,7 +1634,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1818" +NAME="faq-phb-cost" ></A ><B >A.2.20. </B @@ -1668,7 +1668,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1825" +NAME="faq-security-mysql" ></A ><B >A.3.1. </B @@ -1697,7 +1697,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1831" +NAME="faq-security-knownproblems" ></A ><B >A.3.2. </B @@ -1725,7 +1725,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1836" +NAME="faq-security-mysqluser" ></A ><B >A.3.3. </B @@ -1761,7 +1761,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1843" +NAME="faq-email-nomail" ></A ><B >A.4.1. </B @@ -1791,7 +1791,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1849" +NAME="faq-email-testing" ></A ><B >A.4.2. </B @@ -1817,7 +1817,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1854" +NAME="faq-email-whine" ></A ><B >A.4.3. </B @@ -1849,7 +1849,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1860" +NAME="faq-email-procmail" ></A ><B >A.4.4. </B @@ -1867,7 +1867,7 @@ CLASS="answer" You can call bug_email.pl directly from your aliases file, with an entry like this: <A -NAME="AEN1864" +NAME="AEN1894" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" @@ -1888,7 +1888,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1867" +NAME="faq-email-mailif" ></A ><B >A.4.5. </B @@ -1913,7 +1913,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1872" +NAME="faq-email-sendmailnow" ></A ><B >A.4.6. </B @@ -1928,17 +1928,43 @@ CLASS="answer" ><B > </B > - If you are using an alternate Mail Transport Agent (MTA other than - sendmail), make sure the options given in the "processmail" and other - scripts for all - instances of "sendmail" are correct for your MTA. + If you are using an alternate <A +HREF="glossary.html#gloss-mta" +><I +CLASS="glossterm" +>MTA</I +></A +>, + make sure the options given in <TT +CLASS="filename" +>Bugzilla/BugMail.pm</TT +> + and any other place where <SPAN +CLASS="application" +>sendmail</SPAN +> is called from + are correct for your MTA. You should also ensure that the + <TT +CLASS="option" +>sendmailnow</TT +> param is set to <TT +CLASS="literal" +>on</TT +>. </P ><P -> If you are using Sendmail, try enabling "sendmailnow" in editparams.cgi. - If you are using Postfix, you will also need to enable <SPAN -CLASS="QUOTE" ->"sendmailnow"</SPAN +> If you are using <SPAN +CLASS="application" +>sendmail</SPAN +>, try enabling + <TT +CLASS="option" +>sendmailnow</TT +> in <TT +CLASS="filename" +>editparams.cgi</TT >. + </P ></DIV ></DIV @@ -1948,7 +1974,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1879" +NAME="faq-email-nonreceived" ></A ><B >A.4.7. </B @@ -1988,7 +2014,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1887" +NAME="faq-db-oracle" ></A ><B >A.5.1. </B @@ -2016,7 +2042,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1892" +NAME="faq-db-corrupted" ></A ><B >A.5.2. </B @@ -2063,7 +2089,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1900" +NAME="faq-db-manualedit" ></A ><B >A.5.3. </B @@ -2104,7 +2130,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1908" +NAME="faq-db-permissions" ></A ><B >A.5.4. </B @@ -2165,7 +2191,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1916" +NAME="faq-db-synchronize" ></A ><B >A.5.5. </B @@ -2211,7 +2237,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1925" +NAME="faq-nt-easiest" ></A ><B >A.6.1. </B @@ -2236,7 +2262,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1930" +NAME="faq-nt-bundle" ></A ><B >A.6.2. </B @@ -2262,7 +2288,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1935" +NAME="faq-nt-mappings" ></A ><B >A.6.3. </B @@ -2285,7 +2311,7 @@ CLASS="answer" ><P > Microsoft has some advice on this matter, as well: <A -NAME="AEN1940" +NAME="AEN1977" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" @@ -2310,7 +2336,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1943" +NAME="faq-nt-dbi" ></A ><B >A.6.4. </B @@ -2387,7 +2413,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1964" +NAME="faq-use-changeaddress" ></A ><B >A.7.1. </B @@ -2412,7 +2438,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1969" +NAME="faq-use-query" ></A ><B >A.7.2. </B @@ -2438,7 +2464,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1974" +NAME="faq-use-accept" ></A ><B >A.7.3. </B @@ -2493,7 +2519,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1984" +NAME="faq-use-attachment" ></A ><B >A.7.4. </B @@ -2520,7 +2546,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1989" +NAME="faq-use-keyword" ></A ><B >A.7.5. </B @@ -2554,7 +2580,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN1996" +NAME="faq-hacking-templatestyle" ></A ><B >A.8.1. </B @@ -2613,7 +2639,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN2004" +NAME="faq-hacking-bugzillabugs" ></A ><B >A.8.2. </B @@ -2659,7 +2685,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN2013" +NAME="faq-hacking-priority" ></A ><B >A.8.3. </B @@ -2691,7 +2717,7 @@ CLASS="qandaentry" CLASS="question" ><P ><A -NAME="AEN2019" +NAME="faq-hacking-patches" ></A ><B >A.8.4. </B diff --git a/docs/html/gfdl-0.html b/docs/html/gfdl-0.html index 0d99d3bd6..867d14021 100644 --- a/docs/html/gfdl-0.html +++ b/docs/html/gfdl-0.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-1.html b/docs/html/gfdl-1.html index d91dc313e..cd5763be9 100644 --- a/docs/html/gfdl-1.html +++ b/docs/html/gfdl-1.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-10.html b/docs/html/gfdl-10.html index e3c1677e1..4a14d7c62 100644 --- a/docs/html/gfdl-10.html +++ b/docs/html/gfdl-10.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-2.html b/docs/html/gfdl-2.html index f3903c670..7edc97514 100644 --- a/docs/html/gfdl-2.html +++ b/docs/html/gfdl-2.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-3.html b/docs/html/gfdl-3.html index 08bbedb9b..81355bbdb 100644 --- a/docs/html/gfdl-3.html +++ b/docs/html/gfdl-3.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-4.html b/docs/html/gfdl-4.html index a67a24604..47176bd39 100644 --- a/docs/html/gfdl-4.html +++ b/docs/html/gfdl-4.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-5.html b/docs/html/gfdl-5.html index 1702c2b91..e5ca8972a 100644 --- a/docs/html/gfdl-5.html +++ b/docs/html/gfdl-5.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-6.html b/docs/html/gfdl-6.html index 3e2583c2b..b0bca86c5 100644 --- a/docs/html/gfdl-6.html +++ b/docs/html/gfdl-6.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-7.html b/docs/html/gfdl-7.html index c08a7e018..b9742e57d 100644 --- a/docs/html/gfdl-7.html +++ b/docs/html/gfdl-7.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-8.html b/docs/html/gfdl-8.html index dc721637f..fe770bf33 100644 --- a/docs/html/gfdl-8.html +++ b/docs/html/gfdl-8.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-9.html b/docs/html/gfdl-9.html index 81e8904d2..9574a7e4b 100644 --- a/docs/html/gfdl-9.html +++ b/docs/html/gfdl-9.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/gfdl-howto.html b/docs/html/gfdl-howto.html index 3d507f8fa..931236fc5 100644 --- a/docs/html/gfdl-howto.html +++ b/docs/html/gfdl-howto.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="GNU Free Documentation License" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -81,7 +81,7 @@ NAME="gfdl-howto" of the License in the document and put the following copyright and license notices just after the title page:</P ><A -NAME="AEN2267" +NAME="AEN2304" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" diff --git a/docs/html/gfdl.html b/docs/html/gfdl.html index 146cf3ca7..e998ee966 100644 --- a/docs/html/gfdl.html +++ b/docs/html/gfdl.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="SourceForge" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -144,7 +144,7 @@ HREF="gfdl-howto.html" ><P >Version 1.1, March 2000</P ><A -NAME="AEN2177" +NAME="AEN2214" ></A ><BLOCKQUOTE CLASS="BLOCKQUOTE" diff --git a/docs/html/glossary.html b/docs/html/glossary.html index d849ab69d..44e264d45 100644 --- a/docs/html/glossary.html +++ b/docs/html/glossary.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="How to use this License for your documents" @@ -31,7 +31,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -70,7 +70,7 @@ CLASS="glossdiv" ><H1 CLASS="glossdiv" ><A -NAME="AEN2272" +NAME="AEN2309" ></A >0-9, high ascii</H1 ><DL @@ -485,21 +485,78 @@ NAME="gloss-m" >M</H1 ><DL ><DT +><A +NAME="gloss-mta" +></A +><B +>Message Transport Agent</B +></DT +> (MTA)<DD +><P +>A Message Transport Agent is used to control the flow of email + on a system. Many unix based systems use + <A +HREF="http://www.sendmail.org" +TARGET="_top" +>sendmail</A +> which is what + Bugzilla expects to find by default at <TT +CLASS="filename" +>/usr/sbin/sendmail</TT +>. + Many other MTA's will work, but they all require that the + <TT +CLASS="option" +>sendmailnow</TT +> param be set to <TT +CLASS="literal" +>on</TT +>. + </P +></DD +><DT +><A +NAME="gloss-mysql" +></A ><B ->mysqld</B +>MySQL</B ></DT ><DD ><P ->mysqld is the name of the - <I +>MySQL is currently the required + <A +HREF="glossary.html#gloss-rdbms" +><I CLASS="glossterm" ->daemon</I -> - - for the MySQL database. In general, it is invoked automatically - through the use of the System V init scripts on GNU/Linux and - AT&T System V-based systems, such as Solaris and HP/UX, or - through the RC scripts on BSD-based systems.</P +>RDBMS</I +></A +> for Bugzilla. MySQL + can be downloaded from <A +HREF="http://www.mysql.com" +TARGET="_top" +>http://www.mysql.com</A +>. While you + should familiarize yourself with all of the documentation, some high + points are: + </P +><P +></P +><UL +><LI +><P +><A +HREF="http://www.mysql.com/doc/P/r/Privilege_system.html" +TARGET="_top" +>MySQL + Privilege System</A +> - Much more detailed information about + the suggestions in <A +HREF="security.html#security-mysql" +>Section 5.6.2</A +>. + </P +></LI +></UL ></DD ></DL ></DIV @@ -593,6 +650,30 @@ CLASS="glossdiv" ><H1 CLASS="glossdiv" ><A +NAME="gloss-r" +></A +>R</H1 +><DL +><DT +><A +NAME="gloss-rdbms" +></A +><B +>Relational DataBase Managment System</B +></DT +> (RDBMS)<DD +><P +>A relational database management system is a database system + that stores information in tables that are related to each other. + </P +></DD +></DL +></DIV +><DIV +CLASS="glossdiv" +><H1 +CLASS="glossdiv" +><A NAME="gloss-s" ></A >S</H1 diff --git a/docs/html/groups.html b/docs/html/groups.html index 8d6d01f66..dc326202c 100644 --- a/docs/html/groups.html +++ b/docs/html/groups.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/hintsandtips.html b/docs/html/hintsandtips.html index 0b6551188..397c86065 100644 --- a/docs/html/hintsandtips.html +++ b/docs/html/hintsandtips.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Using Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -84,7 +84,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN340" +NAME="AEN370" ></A >3.2.1. Autolinkification</H2 ><P @@ -232,7 +232,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN369" +NAME="AEN399" ></A >3.2.5. Filing Bugs</H2 ><P diff --git a/docs/html/how.html b/docs/html/how.html index f4bfbcba3..1ff255e2c 100644 --- a/docs/html/how.html +++ b/docs/html/how.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Using Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/http.html b/docs/html/http.html index 2025ebe73..38c8b2956 100644 --- a/docs/html/http.html +++ b/docs/html/http.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Installation" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -88,8 +88,8 @@ CLASS="glossterm" should be able to handle Bugzilla. No matter what web server you choose, but especially if you choose something other than Apache, you should be sure to read <A -HREF="security.html" ->Section 5.6</A +HREF="security.html#security-access" +>Section 5.6.4</A >. </P ><P @@ -262,7 +262,7 @@ COLOR="#000000" ><PRE CLASS="programlisting" > # don't allow people to retrieve non-cgi executable files or our private data -<FilesMatch ^(.*\.pl|.*localconfig.*|processmail|runtests.sh)$> +<FilesMatch ^(.*\.pl|.*localconfig.*|runtests.sh)$> deny from all </FilesMatch> <FilesMatch ^(localconfig.js|localconfig.rdf)$> @@ -446,8 +446,8 @@ CLASS="filename" >data</TT > directory are secured as described in <A -HREF="security.html" ->Section 5.6</A +HREF="security.html#security-access" +>Section 5.6.4</A >. </P ></DIV @@ -509,12 +509,14 @@ COLOR="#000000" ><PRE CLASS="programlisting" > ns_register_filter preauth GET /bugzilla/localconfig filter_deny +ns_register_filter preauth GET /bugzilla/localconfig~ filter_deny +ns_register_filter preauth GET /bugzilla/\#localconfig\# filter_deny ns_register_filter preauth GET /bugzilla/*.pl filter_deny -ns_register_filter preauth GET /bugzilla/localconfig filter_deny -ns_register_filter preauth GET /bugzilla/processmail filter_deny ns_register_filter preauth GET /bugzilla/syncshadowdb filter_deny ns_register_filter preauth GET /bugzilla/runtests.sh filter_deny - +ns_register_filter preauth GET /bugzilla/data/* filter_deny +ns_register_filter preauth GET /bugzilla/template/* filter_deny + proc filter_deny { why } { ns_log Notice "filter_deny" return "filter_return" @@ -545,31 +547,84 @@ ALT="Warning"></TD ALIGN="LEFT" VALIGN="TOP" ><P ->This doesn't appear to account for everything mentioned in - <A -HREF="security.html" ->Section 5.6</A ->. In particular, it doesn't block access - to the <TT -CLASS="filename" ->data</TT -> or +>This probably doesn't account for all possible editor backup + files so you may wish to add some additional variations of <TT CLASS="filename" ->template</TT -> directories. It also - doesn't account for the editor backup files that were the topic of +>localconfig</TT +>. For more information, see <A HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383" TARGET="_top" >bug 186383</A ->, <A +> or <A HREF="http://online.securityfocus.com/bid/6501" TARGET="_top" >Bugtraq ID 6501</A +>. + </P +></TD +></TR +></TABLE +></DIV +><DIV +CLASS="note" +><P +></P +><TABLE +CLASS="note" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>If you are using webdot from research.att.com (the default + configuration for the <TT +CLASS="option" +>webdotbase</TT +> paramater), you + will need to allow access to <TT +CLASS="filename" +>data/webdot/*.dot</TT +> + for the reasearch.att.com machine. + </P +><P +>If you are using a local installation of <A +HREF="http://www.graphviz.org" +TARGET="_top" +>GraphViz</A +>, you will need to allow + everybody to access <TT +CLASS="filename" +>*.png</TT >, - and a partial cause for the 2.16.2 release. + <TT +CLASS="filename" +>*.gif</TT +>, <TT +CLASS="filename" +>*.jpg</TT +>, and + <TT +CLASS="filename" +>*.map</TT +> in the + <TT +CLASS="filename" +>data/webdot</TT +> directory. </P ></TD ></TR diff --git a/docs/html/index.html b/docs/html/index.html index 4dfd2a8df..66f407108 100644 --- a/docs/html/index.html +++ b/docs/html/index.html @@ -1,7 +1,7 @@ <HTML ><HEAD ><TITLE ->The Bugzilla Guide</TITLE +>The Bugzilla Guide - 2.17.4 Development Release</TITLE ><META NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ @@ -46,7 +46,7 @@ CLASS="title" ><A NAME="AEN2" ></A ->The Bugzilla Guide</H1 +>The Bugzilla Guide - 2.17.4 Development Release</H1 ><H3 CLASS="author" ><A @@ -58,18 +58,18 @@ CLASS="author" ><A NAME="AEN9" ></A +>Jacob Steenhagen</H3 +><H3 +CLASS="corpauthor" >The Bugzilla Team</H3 ><P -CLASS="edition" ->2.17.3 Development Release Edition </P -><P CLASS="pubdate" ->2003-01-02<BR></P +>2003-02-16<BR></P ><DIV ><DIV CLASS="abstract" ><A -NAME="AEN15" +NAME="AEN14" ></A ><P ></P @@ -335,7 +335,7 @@ HREF="variants.html" ><DL ><DT >D.1. <A -HREF="rhbugzilla.html" +HREF="variant-redhat.html" >Red Hat Bugzilla</A ></DT ><DT diff --git a/docs/html/installation.html b/docs/html/installation.html index fb62a7bc5..36cc6efd6 100644 --- a/docs/html/installation.html +++ b/docs/html/installation.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="User Preferences" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -118,17 +118,17 @@ HREF="stepbystep.html#sbs-http" ></DT ><DT >4.1.7. <A -HREF="stepbystep.html#AEN590" +HREF="stepbystep.html#AEN620" >Bugzilla</A ></DT ><DT >4.1.8. <A -HREF="stepbystep.html#AEN615" +HREF="stepbystep.html#AEN645" >Setting Up the MySQL Database</A ></DT ><DT >4.1.9. <A -HREF="stepbystep.html#AEN651" +HREF="stepbystep.html#AEN681" ><TT CLASS="filename" >checksetup.pl</TT @@ -136,12 +136,7 @@ CLASS="filename" ></DT ><DT >4.1.10. <A -HREF="stepbystep.html#AEN683" ->Securing MySQL</A -></DT -><DT ->4.1.11. <A -HREF="stepbystep.html#AEN749" +HREF="stepbystep.html#AEN713" >Configuring Bugzilla</A ></DT ></DL @@ -155,17 +150,17 @@ HREF="extraconfig.html" ><DL ><DT >4.2.1. <A -HREF="extraconfig.html#AEN755" +HREF="extraconfig.html#AEN719" >Dependency Charts</A ></DT ><DT >4.2.2. <A -HREF="extraconfig.html#AEN770" +HREF="extraconfig.html#AEN734" >Bug Graphs</A ></DT ><DT >4.2.3. <A -HREF="extraconfig.html#AEN783" +HREF="extraconfig.html#AEN747" >The Whining Cron</A ></DT ><DT @@ -181,15 +176,6 @@ HREF="extraconfig.html#content-type" ></DT ><DT >4.2.6. <A -HREF="extraconfig.html#htaccess" -><TT -CLASS="filename" ->.htaccess</TT -> - files and security</A -></DT -><DT ->4.2.7. <A HREF="extraconfig.html#directoryindex" ><TT CLASS="filename" @@ -197,7 +183,7 @@ CLASS="filename" > for the Bugzilla default page.</A ></DT ><DT ->4.2.8. <A +>4.2.7. <A HREF="extraconfig.html#mod_perl" >Bugzilla and <TT CLASS="filename" @@ -205,7 +191,7 @@ CLASS="filename" ></A ></DT ><DT ->4.2.9. <A +>4.2.8. <A HREF="extraconfig.html#mod-throttle" ><TT CLASS="filename" @@ -277,12 +263,12 @@ HREF="troubleshooting.html" ><DL ><DT >4.5.1. <A -HREF="troubleshooting.html#AEN1063" +HREF="troubleshooting.html#AEN1009" >Bundle::Bugzilla makes me upgrade to Perl 5.6.1</A ></DT ><DT >4.5.2. <A -HREF="troubleshooting.html#AEN1068" +HREF="troubleshooting.html#AEN1014" >DBD::Sponge::db prepare failed</A ></DT ><DT diff --git a/docs/html/integration.html b/docs/html/integration.html index b4faa8272..6f99cd39d 100644 --- a/docs/html/integration.html +++ b/docs/html/integration.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/introduction.html b/docs/html/introduction.html index 8ba5d655e..93a0f2c54 100644 --- a/docs/html/introduction.html +++ b/docs/html/introduction.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="Document Conventions" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/newversions.html b/docs/html/newversions.html index 37ccb9755..f8cc4cb70 100644 --- a/docs/html/newversions.html +++ b/docs/html/newversions.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="About This Guide" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -77,7 +77,7 @@ NAME="newversions" ></A >1.3. New Versions</H1 ><P -> This is the 2.17.3 version of The Bugzilla Guide. It is so named +> This is the 2.17.4 version of The Bugzilla Guide. It is so named to match the current version of Bugzilla. This version of the guide, like its associated Bugzilla version is a diff --git a/docs/html/os-specific.html b/docs/html/os-specific.html index f54221ff6..ef29d5a22 100644 --- a/docs/html/os-specific.html +++ b/docs/html/os-specific.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Installation" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -214,11 +214,11 @@ TARGET="_top" ></TABLE ></DIV ><DIV -CLASS="note" +CLASS="tip" ><P ></P ><TABLE -CLASS="note" +CLASS="tip" WIDTH="100%" BORDER="0" ><TR @@ -227,9 +227,9 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" ><IMG -SRC="../images/note.gif" +SRC="../images/tip.gif" HSPACE="5" -ALT="Note"></TD +ALT="Tip"></TD ><TD ALIGN="LEFT" VALIGN="TOP" @@ -358,30 +358,9 @@ CLASS="section" ><H4 CLASS="section" ><A -NAME="win32-code-mail" -></A ->4.3.1.3.2. Making mail work</H4 -><P ->The easiest way to get mail working is to use the mail patches - on <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=124174" -TARGET="_top" ->bug - 124174</A ->. With any luck, this patch will receive the required - reviews and integrated into the main Bugzilla distribution very soon. - Until that happens, there's at least one report of this patch working - well on Windows. - </P -></DIV -><DIV -CLASS="section" -><H4 -CLASS="section" -><A -NAME="AEN930" +NAME="AEN863" ></A ->4.3.1.3.3. System Calls</H4 +>4.3.1.3.2. System Calls</H4 ><P >In order to get system calls to work on win32's perl, you need to tell the windows shell what interpreter to use. This is done by @@ -410,7 +389,7 @@ WIDTH="100%" COLOR="#000000" ><PRE CLASS="programlisting" -> system("./processmail", $id, $exporter); +> system("$webdotbase","-Tpng","-o","$pngfilename","$filename"); </PRE ></FONT ></TD @@ -428,19 +407,12 @@ WIDTH="100%" COLOR="#000000" ><PRE CLASS="programlisting" -> system("C:\\perl\\bin\\perl", "processmail", $id, $exporter); +> system("C:\\perl\\bin\\perl", "$webdotbase","-Tpng","-o","$pngfilename","$filename"); </PRE ></FONT ></TD ></TR ></TABLE -><P ->Notice that the <TT -CLASS="computeroutput" ->./</TT -> is also - removed. - </P ><DIV CLASS="tip" ><P @@ -479,6 +451,51 @@ CLASS="productname" ></TR ></TABLE ></DIV +><DIV +CLASS="note" +><P +></P +><TABLE +CLASS="note" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>It appears that the only <TT +CLASS="function" +>system</TT +> call + remaining in the Bugzilla codebase is in + <TT +CLASS="filename" +>showdependencygraph.cgi</TT +>. Not changing this + file will only cause dependency graphs to not function if the + <TT +CLASS="option" +>webdotbase</TT +> paramater points to a local + installation of <A +HREF="http://www.graphviz.org" +TARGET="_top" +>GraphViz</A +>. + </P +></TD +></TR +></TABLE +></DIV ></DIV ></DIV ><DIV @@ -494,8 +511,8 @@ NAME="win32-http" able to handle Bugzilla; however, the Bugzilla Team still recommends Apache whenever asked. No matter what web server you choose, be sure to pay attention to the security notes in <A -HREF="security.html" ->Section 5.6</A +HREF="security.html#security-access" +>Section 5.6.4</A >. More information on configuring specific web servers can be found in <A diff --git a/docs/html/parameters.html b/docs/html/parameters.html index f96da204c..4954363b4 100644 --- a/docs/html/parameters.html +++ b/docs/html/parameters.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/patches.html b/docs/html/patches.html index 82c0f1078..c554c3ef9 100644 --- a/docs/html/patches.html +++ b/docs/html/patches.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="MySQL Bugzilla Database Introduction" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/programadmin.html b/docs/html/programadmin.html index ab269ba4c..4b5b962ec 100644 --- a/docs/html/programadmin.html +++ b/docs/html/programadmin.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/rewrite.html b/docs/html/rewrite.html index 007f998e6..7ffb0552d 100644 --- a/docs/html/rewrite.html +++ b/docs/html/rewrite.html @@ -10,7 +10,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Useful Patches and Utilities for Bugzilla" @@ -40,7 +40,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/security.html b/docs/html/security.html index 8d1b047d0..47f212524 100644 --- a/docs/html/security.html +++ b/docs/html/security.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -129,60 +129,227 @@ VALIGN="TOP" ><P >These instructions must, of necessity, be somewhat vague since Bugzilla runs on so many different platforms. If you have refinements - of these directions for specific platforms, please submit them to - <A -HREF="mailto://mozilla-webtools@mozilla.org" + of these directions, please submit a bug to <A +HREF="http://bugzilla.mozilla.org/enter_bug.cgi?product=Bugzilla&component=Documentation" TARGET="_top" -> mozilla-webtools@mozilla.org</A -> +>Bugzilla Documentation</A +>. </P ></TD ></TR ></TABLE ></DIV +><DIV +CLASS="warning" +><P +></P +><TABLE +CLASS="warning" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/warning.gif" +HSPACE="5" +ALT="Warning"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>This is not meant to be a comprehensive list of every possible + security issue regarding the tools mentioned in this section. There is + no subsitute for reading the information written by the authors of any + software running on your system. + </P +></TD +></TR +></TABLE +></DIV +><DIV +CLASS="section" +><H2 +CLASS="section" +><A +NAME="security-networking" +></A +>5.6.1. TCP/IP Ports</H2 +><P +>TCP/IP defines 65,000 some ports for trafic. Of those, Bugzilla + only needs 1... 2 if you need to use features that require e-mail such + as bug moving or the e-mail interface from contrib. You should audit + your server and make sure that you aren't listening on any ports you + don't need to be. You may also wish to use some kind of firewall + software to be sure that trafic can only be recieved on ports you + specify. + </P +></DIV +><DIV +CLASS="section" +><H2 +CLASS="section" +><A +NAME="security-mysql" +></A +>5.6.2. MySQL</H2 +><P +>MySQL ships by default with many settings that should be changed. + By defaults it allows anybody to connect from localhost without a + password and have full administrative capabilities. It also defaults to + not have a root password (this is <EM +>not</EM +> the same as + the system root). Also, many installations default to running + <SPAN +CLASS="application" +>mysqld</SPAN +> as the system root. + </P ><P ->To secure your installation: - - <P ></P ><OL TYPE="1" ><LI ><P -> <EM ->There is no substitute for understanding the tools on your - system!</EM -> - - Read - <A -HREF="http://www.mysql.com/doc/P/r/Privilege_system.html" -TARGET="_top" -> The MySQL Privilege System</A -> - until you can recite it from memory!</P +>Consult the documentation that came with your system for + information on making <SPAN +CLASS="application" +>mysqld</SPAN +> run as an + unprivleged user. + </P ></LI ><LI ><P ->Lock down <TT +>You should also be sure to disable the anonymous user account + and set a password for the root user. This is accomplished using the + following commands: + </P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><FONT +COLOR="#000000" +><PRE +CLASS="programlisting" +> <TT +CLASS="prompt" +>bash$</TT +> mysql mysql +<TT +CLASS="prompt" +>mysql></TT +> DELETE FROM user WHERE user = ''; +<TT +CLASS="prompt" +>mysql></TT +> UPDATE user SET password = password('<TT +CLASS="replaceable" +><I +>new_password</I +></TT +>') WHERE user = 'root'; +<TT +CLASS="prompt" +>mysql></TT +> FLUSH PRIVILEGES; + </PRE +></FONT +></TD +></TR +></TABLE +><P +>From this point forward you will need to use + <B +CLASS="command" +>mysql -u root -p</B +> and enter + <TT +CLASS="replaceable" +><I +>new_password</I +></TT +> when prompted when using the + mysql client. + </P +></LI +><LI +><P +>If you run MySQL on the same machine as your httpd server, you + should consider disabling networking from within MySQL by adding + the following to your <TT CLASS="filename" ->/etc/inetd.conf</TT ->. Heck, disable - inet entirely on this box. It should only listen to port 25 for - Sendmail and port 80 for Apache.</P +>/etc/my.conf</TT +>: + </P +><TABLE +BORDER="0" +BGCOLOR="#E0E0E0" +WIDTH="100%" +><TR +><TD +><FONT +COLOR="#000000" +><PRE +CLASS="programlisting" +> [myslqd] +# Prevent network access to MySQL. +skip-networking + </PRE +></FONT +></TD +></TR +></TABLE ></LI ><LI ><P ->Do not run Apache as - <SPAN +>You may also consider running MySQL, or even all of Bugzilla + in a chroot jail; however, instructions for doing that are beyond + the scope of this document. + </P +></LI +></OL +></DIV +><DIV +CLASS="section" +><H2 +CLASS="section" +><A +NAME="security-daemon" +></A +>5.6.3. Daemon Accounts</H2 +><P +>Many daemons, such as Apache's httpd and MySQL's mysqld default to + running as either <SPAN +CLASS="QUOTE" +>"root"</SPAN +> or <SPAN CLASS="QUOTE" >"nobody"</SPAN -> - - . This will require very lax permissions in your Bugzilla - directories. Run it, instead, as a user with a name, set via your - httpd.conf file. - <DIV +>. Running + as <SPAN +CLASS="QUOTE" +>"root"</SPAN +> introduces obvious security problems, but the + problems introduced by running everything as <SPAN +CLASS="QUOTE" +>"nobody"</SPAN +> may + not be so obvious. Basically, if you're running every daemon as + <SPAN +CLASS="QUOTE" +>"nobody"</SPAN +> and one of them gets comprimised, they all get + comprimised. For this reason it is recommended that you create a user + account for each daemon. + </P +><DIV CLASS="note" ><P ></P @@ -203,62 +370,232 @@ ALT="Note"></TD ALIGN="LEFT" VALIGN="TOP" ><P -> <SPAN -CLASS="QUOTE" ->"nobody"</SPAN -> - - is a real user on UNIX systems. Having a process run as user id - <SPAN -CLASS="QUOTE" ->"nobody"</SPAN -> - - is absolutely no protection against system crackers versus using - any other user account. As a general security measure, I recommend - you create unique user ID's for each daemon running on your system - and, if possible, use "chroot" to jail that process away from the - rest of your system.</P +>You will need to set the <TT +CLASS="varname" +>webservergroup</TT +> to + the group you created for your webserver to run as in + <TT +CLASS="filename" +>localconfig</TT +>. This will allow + <B +CLASS="command" +>./checksetup.pl</B +> to better adjust the file + permissions on your Bugzilla install so as to not require making + anything world-writable. + </P ></TD ></TR ></TABLE ></DIV +></DIV +><DIV +CLASS="section" +><H2 +CLASS="section" +><A +NAME="security-access" +></A +>5.6.4. Web Server Access Controls</H2 +><P +>There are many files that are placed in the Bugzilla directory + area that should not be accessable from the web. Because of the way + Bugzilla is currently layed out, the list of what should and should + not be accessible is rather complicated. A new installation method + is currently in the works which should solve this by allowing files + that shouldn't be accessible from the web to be placed in directory + outside the webroot. See + <A +HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=44659" +TARGET="_top" +>bug + 44659</A +> for more information. + </P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>In the main Bugzilla directory, you should:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block: + <TT +CLASS="filename" +>*.pl</TT +>, <TT +CLASS="filename" +>*localconfig*</TT +>, <TT +CLASS="filename" +>runtests.sh</TT > - </P + </P ></LI ><LI ><P ->Ensure you have adequate access controls for the - <TT +>But allow: + <TT CLASS="filename" ->$BUGZILLA_HOME/data/</TT -> directory, as well as the - <TT +>localconfig.js</TT +>, <TT CLASS="filename" ->$BUGZILLA_HOME/localconfig</TT -> file. - The localconfig file stores your "bugs" database account password. - In addition, some - files under <TT +>localconfig.rdf</TT +> + </P +></LI +></UL +></LI +><LI +><P +>In <TT CLASS="filename" ->$BUGZILLA_HOME/data/</TT -> store sensitive - information. - </P +>data</TT +>:</P ><P ->Also, beware that some text editors create backup files in the - current working directory so you need to also secure files like - <TT +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +><LI +><P +>But allow: + <TT CLASS="filename" ->localconfig~</TT ->. - </P +>duplicates.rdf</TT +> + </P +></LI +></UL +></LI +><LI +><P +>In <TT +CLASS="filename" +>data/webdot</TT +>:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>If you use a remote webdot server:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +><LI +><P +>But allow + <TT +CLASS="filename" +>*.dot</TT +> + only for the remote webdot server</P +></LI +></UL +></LI +><LI +><P +>Otherwise, if you use a local GraphViz:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +><LI +><P +>But allow: + <TT +CLASS="filename" +>*.png</TT +>, <TT +CLASS="filename" +>*.gif</TT +>, <TT +CLASS="filename" +>*.jpg</TT +>, <TT +CLASS="filename" +>*.map</TT +> + </P +></LI +></UL +></LI +><LI +><P +>And if you don't use any dot:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +></UL +></LI +></UL +></LI +><LI +><P +>In <TT +CLASS="filename" +>Bugzilla</TT +>:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +></UL +></LI +><LI +><P +>In <TT +CLASS="filename" +>template</TT +>:</P +><P +></P +><UL +COMPACT="COMPACT" +><LI +><P +>Block everything</P +></LI +></UL +></LI +></UL ><DIV -CLASS="note" +CLASS="tip" ><P ></P ><TABLE -CLASS="note" +CLASS="tip" WIDTH="100%" BORDER="0" ><TR @@ -267,102 +604,64 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" ><IMG -SRC="../images/note.gif" +SRC="../images/tip.gif" HSPACE="5" -ALT="Note"></TD +ALT="Tip"></TD ><TD ALIGN="LEFT" VALIGN="TOP" ><P ->Simply blocking <TT -CLASS="computeroutput" ->.*localconfig.*</TT -> - won't work because the QuickSearch feature requires the web browser - to be able to retrieve <TT +>Bugzilla ships with the ability to generate + <TT CLASS="filename" ->localconfig.js</TT -> and - others may be introduced in the future (see - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383" -TARGET="_top" ->bug - 186383</A -> for more information. - </P +>.htaccess</TT +> files instructing + <A +HREF="glossary.html#gloss-apache" +><I +CLASS="glossterm" +>Apache</I +></A +> which files + should and should not be accessible. For more information, see + <A +HREF="http.html#http-apache" +>Section 4.4.1</A +>. + </P ></TD ></TR ></TABLE ></DIV ><P ->Bugzilla provides default <TT -CLASS="filename" ->.htaccess</TT -> files - to protect the most common Apache installations. However, you should - verify these are adequate according to the site-wide security policy - of your web server, and ensure that the <TT -CLASS="filename" ->.htaccess</TT -> - files are allowed to <SPAN -CLASS="QUOTE" ->"override"</SPAN -> default permissions set - in your Apache configuration files. Covering Apache security is beyond - the scope of this Guide; please consult the Apache documentation for - details. - </P -><P ->If you are using a web server that does not support the - <TT -CLASS="filename" ->.htaccess</TT -> control method, - <EM ->you are at risk!</EM -> - - After installing, check to see if you can view the file - <TT +>You should test to make sure that the files mentioned above are + not accessible from the Internet, especially your + <TT CLASS="filename" >localconfig</TT -> in your web browser (e.g.: - <A +> file which contains your database + password. To test, simply point your web browser at the file; for + example, to test mozilla.org's installation, we'd try to access + <A HREF="http://bugzilla.mozilla.org/localconfig" TARGET="_top" -> http://bugzilla.mozilla.org/localconfig</A +>http://bugzilla.mozilla.org/localconfig</A +>. You should + get a <SPAN +CLASS="errorcode" +>403</SPAN +> <SPAN +CLASS="errorname" +>Forbidden</SPAN > - - ). If you can read the contents of this file, your web server has - not secured your bugzilla directory properly and you must fix this - problem before deploying Bugzilla. If, however, it gives you a - "Forbidden" error, then it probably respects the .htaccess - conventions and you are good to go.</P -></LI -><LI -><P ->When you run checksetup.pl, the script will attempt to modify - various permissions on files which Bugzilla uses. If you do not have - a webservergroup set in the <TT -CLASS="filename" ->localconfig</TT -> file, - then Bugzilla will have to make certain files world readable and/or - writable. - <EM ->THIS IS INSECURE!</EM -> - - . This means that anyone who can get access to your system can do - whatever they want to your Bugzilla installation.</P + error. + </P ><DIV -CLASS="note" +CLASS="caution" ><P ></P ><TABLE -CLASS="note" +CLASS="caution" WIDTH="100%" BORDER="0" ><TR @@ -371,90 +670,55 @@ WIDTH="25" ALIGN="CENTER" VALIGN="TOP" ><IMG -SRC="../images/note.gif" +SRC="../images/caution.gif" HSPACE="5" -ALT="Note"></TD +ALT="Caution"></TD ><TD ALIGN="LEFT" VALIGN="TOP" ><P ->This also means that if your webserver runs all cgi scripts - as the same user/group, anyone on the system who can run cgi - scripts will be able to take control of your Bugzilla - installation.</P +>Not following the instructions in this section, including + testing, may result in sensitive information being globally + accessible. + </P ></TD ></TR ></TABLE ></DIV +><DIV +CLASS="tip" ><P ->On Apache, you can use <TT -CLASS="filename" ->.htaccess</TT -> files to - protect access to these directories, as outlined in Bugs - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=57161" -TARGET="_top" -> 57161</A -> and - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383" -TARGET="_top" -> 186383</A -> - - for the <TT -CLASS="filename" ->localconfig</TT -> file, and - <A -HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=65572" -TARGET="_top" ->Bug - 65572</A -> - - for adequate protection in your <TT -CLASS="filename" ->data/</TT -> directory. - Also, don't forget about the <TT -CLASS="filename" ->template/</TT -> and - <TT -CLASS="filename" ->Bugzilla/</TT -> directories and to allow access to the - <TT -CLASS="filename" ->data/webdot</TT -> directory for the - <TT -CLASS="computeroutput" ->192.20.225.10</TT -> IP address if you are - using webdot from research.att.com. The easiest way to - accomplish this is to set <TT -CLASS="function" ->$create_htaccess</TT -> to 1 - in <TT -CLASS="filename" ->localconfig</TT ->. However, the information below - is provided for those that want to know exactly what is created. - </P +></P +><TABLE +CLASS="tip" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="../images/tip.gif" +HSPACE="5" +ALT="Tip"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" ><P ->FIX ME BEFORE RELEASE!!!!! - Note the instructions which follow are Apache-specific. If you - use IIS, Netscape, or other non-Apache web servers, please consult - your system documentation for how to secure these files from being - transmitted to curious users.</P -></LI -></OL -> - </P +>You should check <A +HREF="http.html" +>Section 4.4</A +> to see if instructions + have been included for your web server. You should also compare those + instructions with this list to make sure everything is properly + accounted for. + </P +></TD +></TR +></TABLE +></DIV +></DIV ></DIV ><DIV CLASS="NAVFOOTER" diff --git a/docs/html/stepbystep.html b/docs/html/stepbystep.html index 5e5a09522..8de6806b1 100644 --- a/docs/html/stepbystep.html +++ b/docs/html/stepbystep.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Installation" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -863,7 +863,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN556" +NAME="AEN586" ></A >4.1.5.1. DBI</H3 ><P @@ -878,7 +878,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN559" +NAME="AEN589" ></A >4.1.5.2. Data::Dumper</H3 ><P @@ -892,7 +892,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN562" +NAME="AEN592" ></A >4.1.5.3. MySQL-related modules</H3 ><P @@ -918,7 +918,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN567" +NAME="AEN597" ></A >4.1.5.4. TimeDate modules</H3 ><P @@ -934,7 +934,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN570" +NAME="AEN600" ></A >4.1.5.5. GD (optional)</H3 ><P @@ -989,7 +989,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN577" +NAME="AEN607" ></A >4.1.5.6. Chart::Base (optional)</H3 ><P @@ -1004,7 +1004,7 @@ CLASS="section" ><H3 CLASS="section" ><A -NAME="AEN580" +NAME="AEN610" ></A >4.1.5.7. Template Toolkit</H3 ><P @@ -1073,7 +1073,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN590" +NAME="AEN620" ></A >4.1.7. Bugzilla</H2 ><P @@ -1223,7 +1223,7 @@ WIDTH="100%" COLOR="#000000" ><PRE CLASS="programlisting" -> perl -pi -e 's@#\!/usr/bonsaitools/bin/perl@#\!/usr/bin/perl@' *cgi *pl Bug.pm processmail syncshadowdb +> perl -pi -e 's@#\!/usr/bonsaitools/bin/perl@#\!/usr/bin/perl@' *cgi *pl Bug.pm syncshadowdb </PRE ></FONT ></TD @@ -1243,7 +1243,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN615" +NAME="AEN645" ></A >4.1.8. Setting Up the MySQL Database</H2 ><P @@ -1416,7 +1416,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN651" +NAME="AEN681" ></A >4.1.9. <TT CLASS="filename" @@ -1569,287 +1569,9 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN683" +NAME="AEN713" ></A ->4.1.10. Securing MySQL</H2 -><P ->If you followed the installation instructions for setting up your - "bugs" and "root" user in MySQL, much of this should not apply to you. - If you are upgrading an existing installation of Bugzilla, you should - pay close attention to this section.</P -><P ->Most MySQL installs have "interesting" default security - parameters: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->mysqld defaults to running as root</TD -></TR -><TR -><TD ->it defaults to allowing external network connections</TD -></TR -><TR -><TD ->it has a known port number, and is easy to detect</TD -></TR -><TR -><TD ->it defaults to no passwords whatsoever</TD -></TR -><TR -><TD ->it defaults to allowing "File_Priv"</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->This means anyone from anywhere on the Internet can not only drop - the database with one SQL command, and they can write as root to the - system.</P -><P ->To see your permissions do: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->bash#</TT -> - - <B -CLASS="command" ->mysql -u root -p</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->use mysql;</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->show tables;</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->select * from user;</B -> - </TT -> - </TD -></TR -><TR -><TD -> <TT -CLASS="computeroutput" -> <TT -CLASS="prompt" ->mysql></TT -> - - <B -CLASS="command" ->select * from db;</B -> - </TT -> - </TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->To fix the gaping holes: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->DELETE FROM user WHERE User='';</TD -></TR -><TR -><TD ->UPDATE user SET Password=PASSWORD('new_password') WHERE - user='root';</TD -></TR -><TR -><TD ->FLUSH PRIVILEGES;</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->If you're not running "mit-pthreads" you can use: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->GRANT USAGE ON *.* TO bugs@localhost;</TD -></TR -><TR -><TD ->GRANT ALL ON bugs.* TO bugs@localhost;</TD -></TR -><TR -><TD ->REVOKE DROP ON bugs.* FROM bugs@localhost;</TD -></TR -><TR -><TD ->FLUSH PRIVILEGES;</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->With "mit-pthreads" you'll need to modify the "globals.pl" - Mysql->Connect line to specify a specific host name instead of - "localhost", and accept external connections: - <P -></P -><TABLE -BORDER="0" -><TBODY -><TR -><TD ->GRANT USAGE ON *.* TO bugs@bounce.hop.com;</TD -></TR -><TR -><TD ->GRANT ALL ON bugs.* TO bugs@bounce.hop.com;</TD -></TR -><TR -><TD ->REVOKE DROP ON bugs.* FROM bugs@bounce.hop.com;</TD -></TR -><TR -><TD ->FLUSH PRIVILEGES;</TD -></TR -></TBODY -></TABLE -><P -></P -> - </P -><P ->Consider also: - <P -></P -><OL -TYPE="1" -><LI -><P ->Turning off external networking with "--skip-networking", - unless you have "mit-pthreads", in which case you can't. Without - networking, MySQL connects with a Unix domain socket.</P -></LI -><LI -><P ->using the --user= option to mysqld to run it as an - unprivileged user.</P -></LI -><LI -><P ->running MySQL in a chroot jail</P -></LI -><LI -><P ->running the httpd in a chroot jail</P -></LI -><LI -><P ->making sure the MySQL passwords are different from the OS - passwords (MySQL "root" has nothing to do with system - "root").</P -></LI -><LI -><P ->running MySQL on a separate untrusted machine</P -></LI -><LI -><P ->making backups ;-)</P -></LI -></OL -> - </P -></DIV -><DIV -CLASS="section" -><H2 -CLASS="section" -><A -NAME="AEN749" -></A ->4.1.11. Configuring Bugzilla</H2 +>4.1.10. Configuring Bugzilla</H2 ><P > You should run through the parameters on the Edit Parameters page (link in the footer) and set them all to appropriate values. diff --git a/docs/html/troubleshooting.html b/docs/html/troubleshooting.html index 924c70f50..9b4a2c2cd 100644 --- a/docs/html/troubleshooting.html +++ b/docs/html/troubleshooting.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Installation" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -85,7 +85,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN1063" +NAME="AEN1009" ></A >4.5.1. Bundle::Bugzilla makes me upgrade to Perl 5.6.1</H2 ><P @@ -110,7 +110,7 @@ CLASS="section" ><H2 CLASS="section" ><A -NAME="AEN1068" +NAME="AEN1014" ></A >4.5.2. DBD::Sponge::db prepare failed</H2 ><P diff --git a/docs/html/upgrading.html b/docs/html/upgrading.html index 2f58b007b..f59442061 100644 --- a/docs/html/upgrading.html +++ b/docs/html/upgrading.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/useradmin.html b/docs/html/useradmin.html index 7dc8cb73d..89bd94da5 100644 --- a/docs/html/useradmin.html +++ b/docs/html/useradmin.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/userpreferences.html b/docs/html/userpreferences.html index a59b52e9c..6eb40d050 100644 --- a/docs/html/userpreferences.html +++ b/docs/html/userpreferences.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Using Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/using.html b/docs/html/using.html index 36596aabe..80d1e1225 100644 --- a/docs/html/using.html +++ b/docs/html/using.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="Why Should We Use Bugzilla?" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -122,7 +122,7 @@ HREF="hintsandtips.html" ><DL ><DT >3.2.1. <A -HREF="hintsandtips.html#AEN340" +HREF="hintsandtips.html#AEN370" >Autolinkification</A ></DT ><DT @@ -142,7 +142,7 @@ HREF="hintsandtips.html#attachments" ></DT ><DT >3.2.5. <A -HREF="hintsandtips.html#AEN369" +HREF="hintsandtips.html#AEN399" >Filing Bugs</A ></DT ></DL diff --git a/docs/html/variant-fenris.html b/docs/html/variant-fenris.html index dcdf73f0c..80504de96 100644 --- a/docs/html/variant-fenris.html +++ b/docs/html/variant-fenris.html @@ -7,14 +7,14 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Bugzilla Variants and Competitors" HREF="variants.html"><LINK REL="PREVIOUS" TITLE="Red Hat Bugzilla" -HREF="rhbugzilla.html"><LINK +HREF="variant-redhat.html"><LINK REL="NEXT" TITLE="Issuezilla" HREF="variant-issuezilla.html"></HEAD @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -45,7 +45,7 @@ WIDTH="10%" ALIGN="left" VALIGN="bottom" ><A -HREF="rhbugzilla.html" +HREF="variant-redhat.html" ACCESSKEY="P" >Prev</A ></TD @@ -100,7 +100,7 @@ WIDTH="33%" ALIGN="left" VALIGN="top" ><A -HREF="rhbugzilla.html" +HREF="variant-redhat.html" ACCESSKEY="P" >Prev</A ></TD diff --git a/docs/html/variant-issuezilla.html b/docs/html/variant-issuezilla.html index d6223a6b0..253e3cda5 100644 --- a/docs/html/variant-issuezilla.html +++ b/docs/html/variant-issuezilla.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Bugzilla Variants and Competitors" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -82,7 +82,7 @@ NAME="variant-issuezilla" at tigris.org is their Java-based bug-tracker, <A HREF="variant-scarab.html" ->Scarab</A +>Section D.4</A >.</P ><P >This section last updated 27 Jul 2002</P diff --git a/docs/html/variant-perforce.html b/docs/html/variant-perforce.html index 3e0fc3cd0..7a6f2c097 100644 --- a/docs/html/variant-perforce.html +++ b/docs/html/variant-perforce.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Bugzilla Variants and Competitors" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/rhbugzilla.html b/docs/html/variant-redhat.html index d968bae6d..735fe03ed 100644 --- a/docs/html/rhbugzilla.html +++ b/docs/html/variant-redhat.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Bugzilla Variants and Competitors" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -73,7 +73,7 @@ CLASS="section" ><H1 CLASS="section" ><A -NAME="rhbugzilla" +NAME="variant-redhat" ></A >D.1. Red Hat Bugzilla</H1 ><P diff --git a/docs/html/variant-scarab.html b/docs/html/variant-scarab.html index b5840e3de..4e5fc3b99 100644 --- a/docs/html/variant-scarab.html +++ b/docs/html/variant-scarab.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Bugzilla Variants and Competitors" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/variant-sourceforge.html b/docs/html/variant-sourceforge.html index 068bfe6c4..f46f30b9b 100644 --- a/docs/html/variant-sourceforge.html +++ b/docs/html/variant-sourceforge.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Bugzilla Variants and Competitors" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/variants.html b/docs/html/variants.html index 712a6125f..f8c23cd7d 100644 --- a/docs/html/variants.html +++ b/docs/html/variants.html @@ -7,14 +7,14 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="PREVIOUS" TITLE="Command-line Bugzilla Queries" HREF="cmdline.html"><LINK REL="NEXT" TITLE="Red Hat Bugzilla" -HREF="rhbugzilla.html"></HEAD +HREF="variant-redhat.html"></HEAD ><BODY CLASS="appendix" BGCOLOR="#FFFFFF" @@ -34,7 +34,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD @@ -56,7 +56,7 @@ WIDTH="10%" ALIGN="right" VALIGN="bottom" ><A -HREF="rhbugzilla.html" +HREF="variant-redhat.html" ACCESSKEY="N" >Next</A ></TD @@ -81,7 +81,7 @@ CLASS="TOC" ></DT ><DT >D.1. <A -HREF="rhbugzilla.html" +HREF="variant-redhat.html" >Red Hat Bugzilla</A ></DT ><DT @@ -157,7 +157,7 @@ WIDTH="33%" ALIGN="right" VALIGN="top" ><A -HREF="rhbugzilla.html" +HREF="variant-redhat.html" ACCESSKEY="N" >Next</A ></TD diff --git a/docs/html/voting.html b/docs/html/voting.html index 03b41cc94..78b0c381c 100644 --- a/docs/html/voting.html +++ b/docs/html/voting.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Administering Bugzilla" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/whatis.html b/docs/html/whatis.html index 7c57399a3..c813aaf1f 100644 --- a/docs/html/whatis.html +++ b/docs/html/whatis.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Introduction" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/html/why.html b/docs/html/why.html index 35daf683b..e6a254cee 100644 --- a/docs/html/why.html +++ b/docs/html/why.html @@ -7,7 +7,7 @@ NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" -TITLE="The Bugzilla Guide" +TITLE="The Bugzilla Guide - 2.17.4 Development Release" HREF="index.html"><LINK REL="UP" TITLE="Introduction" @@ -37,7 +37,7 @@ CELLSPACING="0" ><TH COLSPAN="3" ALIGN="center" ->The Bugzilla Guide</TH +>The Bugzilla Guide - 2.17.4 Development Release</TH ></TR ><TR ><TD diff --git a/docs/txt/Bugzilla-Guide.txt b/docs/txt/Bugzilla-Guide.txt index ce90ed22f..5b3fd7f8c 100644 --- a/docs/txt/Bugzilla-Guide.txt +++ b/docs/txt/Bugzilla-Guide.txt @@ -1,13 +1,13 @@ -The Bugzilla Guide +The Bugzilla Guide - 2.17.4 Development Release Matthew P. Barnson -The Bugzilla Team +Jacob Steenhagen - 2.17.3 Development Release Edition +The Bugzilla Team - 2003-01-02 + 2003-02-16 This is the documentation for Bugzilla, the mozilla.org bug-tracking system. Bugzilla is an enterprise-class piece of software that powers @@ -166,7 +166,7 @@ Chapter 1. About This Guide 1.3. New Versions - This is the 2.17.3 version of The Bugzilla Guide. It is so named to + This is the 2.17.4 version of The Bugzilla Guide. It is so named to match the current version of Bugzilla. This version of the guide, like its associated Bugzilla version is a development version. Information is subject to change between now and when 2.18 is released. If you are @@ -196,32 +196,41 @@ Chapter 1. About This Guide efforts, numerous e-mail and IRC support sessions, and overall excellent contribution to the Bugzilla community: - Matthew P. Barnson for the Herculaean task of pulling together the - Bugzilla Guide and shepherding it to 2.14. + Matthew P. Barnson <mbarnson@sisna.com> + for the Herculaean task of pulling together the Bugzilla Guide + and shepherding it to 2.14. + + Terry Weissman <terry@mozilla.org> + for initially writing Bugzilla and creating the README upon + which the UNIX installation documentation is largely based. - Terry Weissman for initially writing Bugzilla and creating the README - upon which the UNIX installation documentation is largely based. + Tara Hernandez <tara@tequilarists.org> + for keeping Bugzilla development going strong after Terry left + mozilla.org and for running landfill. - Tara Hernandez for keeping Bugzilla development going strong after - Terry left mozilla.org + Dave Lawrence <dkl@redhat.com> + for providing insight into the key differences between Red + Hat's customized Bugzilla, and being largely responsible for + Section D.1. - Dave Lawrence for providing insight into the key differences between - Red Hat's customized Bugzilla, and being largely responsible for the - "Red Hat Bugzilla" appendix + Dawn Endico <endico@mozilla.org> + for being a hacker extraordinaire and putting up with Matthew's + incessant questions and arguments on irc.mozilla.org in + #mozwebtools - Dawn Endico for being a hacker extraordinaire and putting up with my - incessant questions and arguments on irc.mozilla.org in #mozwebtools + Jacob Steenhagen <jake@bugzilla.org> + for taking over documentation during the 2.17 development + period. Last but not least, all the members of the - netscape.public.mozilla.webtools newsgroup. Without your discussions, - insight, suggestions, and patches, this could never have happened. + news://news.mozilla.org/netscape/public/mozilla/webtools newsgroup. + Without your discussions, insight, suggestions, and patches, this + could never have happened. Thanks also go to the following people for significant contributions - to this documentation (in no particular order): - - Zach Liption, Andrew Pearson, Spencer Smith, Eric Hanson, Kevin - Brannen, Ron Teitelbaum, Jacob Steenhagen, Joe Robins, Gervase - Markham. + to this documentation (in alphabetical order): Andrew Pearson, Ben + FrantzDale, Eric Hanson, Gervase Markham, Joe Robins, Kevin Brannen, + Ron Teitelbaum, Spencer Smith, Zach Liption . _________________________________________________________________ 1.5. Document Conventions @@ -951,7 +960,7 @@ Chapter 4. Installation to perl on your system inside /usr/bonsaitools/bin perl -pi -e 's@#\!/usr/bonsaitools/bin/perl@#\!/usr/bin/perl@' *cgi *pl Bug.pm -processmail syncshadowdb +syncshadowdb Change /usr/bin/perl to match the location of Perl on your machine. _________________________________________________________________ @@ -1031,71 +1040,7 @@ processmail syncshadowdb Bugzilla. _________________________________________________________________ -4.1.10. Securing MySQL - - If you followed the installation instructions for setting up your - "bugs" and "root" user in MySQL, much of this should not apply to you. - If you are upgrading an existing installation of Bugzilla, you should - pay close attention to this section. - - Most MySQL installs have "interesting" default security parameters: - - mysqld defaults to running as root - it defaults to allowing external network connections - it has a known port number, and is easy to detect - it defaults to no passwords whatsoever - it defaults to allowing "File_Priv" - - This means anyone from anywhere on the Internet can not only drop the - database with one SQL command, and they can write as root to the - system. - - To see your permissions do: - - bash# mysql -u root -p - mysql> use mysql; - mysql> show tables; - mysql> select * from user; - mysql> select * from db; - - To fix the gaping holes: - - DELETE FROM user WHERE User=''; - UPDATE user SET Password=PASSWORD('new_password') WHERE user='root'; - FLUSH PRIVILEGES; - - If you're not running "mit-pthreads" you can use: - - GRANT USAGE ON *.* TO bugs@localhost; - GRANT ALL ON bugs.* TO bugs@localhost; - REVOKE DROP ON bugs.* FROM bugs@localhost; - FLUSH PRIVILEGES; - - With "mit-pthreads" you'll need to modify the "globals.pl" - Mysql->Connect line to specify a specific host name instead of - "localhost", and accept external connections: - - GRANT USAGE ON *.* TO bugs@bounce.hop.com; - GRANT ALL ON bugs.* TO bugs@bounce.hop.com; - REVOKE DROP ON bugs.* FROM bugs@bounce.hop.com; - FLUSH PRIVILEGES; - - Consider also: - - 1. Turning off external networking with "--skip-networking", unless - you have "mit-pthreads", in which case you can't. Without - networking, MySQL connects with a Unix domain socket. - 2. using the --user= option to mysqld to run it as an unprivileged - user. - 3. running MySQL in a chroot jail - 4. running the httpd in a chroot jail - 5. making sure the MySQL passwords are different from the OS - passwords (MySQL "root" has nothing to do with system "root"). - 6. running MySQL on a separate untrusted machine - 7. making backups ;-) - _________________________________________________________________ - -4.1.11. Configuring Bugzilla +4.1.10. Configuring Bugzilla You should run through the parameters on the Edit Parameters page (link in the footer) and set them all to appropriate values. They key @@ -1255,45 +1200,7 @@ set=ISO-8859-1/i" *.cgi *.pl making bugzilla charset aware by default. _________________________________________________________________ -4.2.6. .htaccess files and security - - To enhance the security of your Bugzilla installation, Bugzilla's - checksetup.pl script will generate .htaccess files which the Apache - webserver can use to restrict access to the bugzilla data files. These - .htaccess files will not work with Apache 1.2.x - but this has - security holes, so you shouldn't be using it anyway. - - Note - - If you are using an alternate provider of webdot services for graphing - (as described when viewing editparams.cgi in your web browser), you - will need to change the ip address in data/webdot/.htaccess to the ip - address of the webdot server that you are using. - - The default .htaccess file may not provide adequate access - restrictions, depending on your web server configuration. Be sure to - check the <Directory> entries for your Bugzilla directory so that the - .htaccess file is allowed to override web server defaults. For - instance, let's assume your installation of Bugzilla is installed to - /usr/local/bugzilla . You should have this <Directory> entry in your - httpd.conf file: - -<Directory /usr/local/bugzilla/> - Options +FollowSymLinks +Indexes +Includes +ExecCGI - AllowOverride All -</Directory> - - The important part above is "AllowOverride All" . Without that, the - .htaccess file created by checksetup.pl will not have sufficient - permissions to protect your Bugzilla installation. - - If you are using Internet Information Server (IIS) or another web - server which does not observe .htaccess conventions, you can disable - their creation by editing localconfig and setting the $create_htaccess - variable to 0. - _________________________________________________________________ - -4.2.7. directoryindex for the Bugzilla default page. +4.2.6. directoryindex for the Bugzilla default page. You should modify the <DirectoryIndex> parameter for the Apache virtual host running your Bugzilla installation to allow index.cgi as @@ -1301,13 +1208,13 @@ set=ISO-8859-1/i" *.cgi *.pl index.htm, and so forth. _________________________________________________________________ -4.2.8. Bugzilla and mod_perl +4.2.7. Bugzilla and mod_perl Bugzilla is unsupported under mod_perl. Effort is underway to make it work cleanly in a mod_perl environment, but it is slow going. _________________________________________________________________ -4.2.9. mod_throttle and Security +4.2.8. mod_throttle and Security It is possible for a user, by mistake or on purpose, to access the database many times in a row which can result in very slow access @@ -1369,7 +1276,7 @@ C:\perl> ppm <module name> Template Toolkit. The Template Toolkit website suggests using the instructions on OpenInteract's website. - Note + Tip A complete list of modules that can be installed using ppm can be found at http://www.activestate.com/PPMPackages/5.6plus. @@ -1400,33 +1307,30 @@ my $webservergid = getgrnam($my_webservergroup) my $webservergid = '8' _________________________________________________________________ -4.3.1.3.2. Making mail work - - The easiest way to get mail working is to use the mail patches on bug - 124174. With any luck, this patch will receive the required reviews - and integrated into the main Bugzilla distribution very soon. Until - that happens, there's at least one report of this patch working well - on Windows. - _________________________________________________________________ - -4.3.1.3.3. System Calls +4.3.1.3.2. System Calls In order to get system calls to work on win32's perl, you need to tell the windows shell what interpreter to use. This is done by changing the system calls. You will need to search all of Bugzilla's code for system calls. To tell perl your interpreter, it needs to be the first argument to the system call. For example, you'll need to change: -system("./processmail", $id, $exporter); +system("$webdotbase","-Tpng","-o","$pngfilename","$filename"); with -system("C:\\perl\\bin\\perl", "processmail", $id, $exporter); - - Notice that the ./ is also removed. +system("C:\\perl\\bin\\perl", "$webdotbase","-Tpng","-o","$pngfilename","$filen +ame"); Tip The grep command is very helpful in finding these system calls, assuming you have the cygwin utilities. + + Note + + It appears that the only system call remaining in the Bugzilla + codebase is in showdependencygraph.cgi. Not changing this file will + only cause dependency graphs to not function if the webdotbase + paramater points to a local installation of GraphViz. _________________________________________________________________ 4.3.1.4. Serving the web pages @@ -1434,7 +1338,7 @@ system("C:\\perl\\bin\\perl", "processmail", $id, $exporter); As is the case on Unix based systems, any web server should be able to handle Bugzilla; however, the Bugzilla Team still recommends Apache whenever asked. No matter what web server you choose, be sure to pay - attention to the security notes in Section 5.6. More information on + attention to the security notes in Section 5.6.4. More information on configuring specific web servers can be found in Section 4.4. Note @@ -1492,7 +1396,7 @@ system("C:\\perl\\bin\\perl", "processmail", $id, $exporter); web server that can be configured to run CGI scripts should be able to handle Bugzilla. No matter what web server you choose, but especially if you choose something other than Apache, you should be sure to read - Section 5.6. + Section 5.6.4. The plan for this section is to eventually document the specifics of how to lock down permissions on individual web servers. @@ -1535,7 +1439,7 @@ AllowOverride Limit $BUGZILLA_HOME/.htaccess # don't allow people to retrieve non-cgi executable files or our private data -<FilesMatch ^(.*\.pl|.*localconfig.*|processmail|runtests.sh)$> +<FilesMatch ^(.*\.pl|.*localconfig.*|runtests.sh)$> deny from all </FilesMatch> <FilesMatch ^(localconfig.js|localconfig.rdf)$> @@ -1591,7 +1495,7 @@ deny from all Also, and this can't be stressed enough, make sure that files such as localconfig and your data directory are secured as described in - Section 5.6. + Section 5.6.4. _________________________________________________________________ 4.4.3. AOL Server @@ -1609,11 +1513,14 @@ deny from all with the following contents (change /bugzilla/ to the web-based path to your Bugzilla installation): ns_register_filter preauth GET /bugzilla/localconfig filter_deny +ns_register_filter preauth GET /bugzilla/localconfig~ filter_deny +ns_register_filter preauth GET /bugzilla/\#localconfig\# filter_deny ns_register_filter preauth GET /bugzilla/*.pl filter_deny -ns_register_filter preauth GET /bugzilla/localconfig filter_deny -ns_register_filter preauth GET /bugzilla/processmail filter_deny ns_register_filter preauth GET /bugzilla/syncshadowdb filter_deny ns_register_filter preauth GET /bugzilla/runtests.sh filter_deny +ns_register_filter preauth GET /bugzilla/data/* filter_deny +ns_register_filter preauth GET /bugzilla/template/* filter_deny + proc filter_deny { why } { ns_log Notice "filter_deny" @@ -1622,11 +1529,19 @@ proc filter_deny { why } { Warning - This doesn't appear to account for everything mentioned in Section - 5.6. In particular, it doesn't block access to the data or template - directories. It also doesn't account for the editor backup files that - were the topic of bug 186383, Bugtraq ID 6501, and a partial cause for - the 2.16.2 release. + This probably doesn't account for all possible editor backup files so + you may wish to add some additional variations of localconfig. For + more information, see bug 186383 or Bugtraq ID 6501. + + Note + + If you are using webdot from research.att.com (the default + configuration for the webdotbase paramater), you will need to allow + access to data/webdot/*.dot for the reasearch.att.com machine. + + If you are using a local installation of GraphViz, you will need to + allow everybody to access *.png, *.gif, *.jpg, and *.map in the + data/webdot directory. _________________________________________________________________ 4.5. Troubleshooting @@ -2124,87 +2039,133 @@ Chapter 5. Administering Bugzilla These instructions must, of necessity, be somewhat vague since Bugzilla runs on so many different platforms. If you have refinements - of these directions for specific platforms, please submit them to - mozilla-webtools@mozilla.org + of these directions, please submit a bug to Bugzilla Documentation. - To secure your installation: + Warning + + This is not meant to be a comprehensive list of every possible + security issue regarding the tools mentioned in this section. There is + no subsitute for reading the information written by the authors of any + software running on your system. + _________________________________________________________________ - 1. There is no substitute for understanding the tools on your system! - Read The MySQL Privilege System until you can recite it from - memory! - 2. Lock down /etc/inetd.conf. Heck, disable inet entirely on this - box. It should only listen to port 25 for Sendmail and port 80 for - Apache. - 3. Do not run Apache as "nobody" . This will require very lax - permissions in your Bugzilla directories. Run it, instead, as a - user with a name, set via your httpd.conf file. +5.6.1. TCP/IP Ports - Note + TCP/IP defines 65,000 some ports for trafic. Of those, Bugzilla only + needs 1... 2 if you need to use features that require e-mail such as + bug moving or the e-mail interface from contrib. You should audit your + server and make sure that you aren't listening on any ports you don't + need to be. You may also wish to use some kind of firewall software to + be sure that trafic can only be recieved on ports you specify. + _________________________________________________________________ - "nobody" is a real user on UNIX systems. Having a process run as user - id "nobody" is absolutely no protection against system crackers versus - using any other user account. As a general security measure, I - recommend you create unique user ID's for each daemon running on your - system and, if possible, use "chroot" to jail that process away from - the rest of your system. - 4. Ensure you have adequate access controls for the - $BUGZILLA_HOME/data/ directory, as well as the - $BUGZILLA_HOME/localconfig file. The localconfig file stores your - "bugs" database account password. In addition, some files under - $BUGZILLA_HOME/data/ store sensitive information. - Also, beware that some text editors create backup files in the - current working directory so you need to also secure files like - localconfig~. +5.6.2. MySQL - Note + MySQL ships by default with many settings that should be changed. By + defaults it allows anybody to connect from localhost without a + password and have full administrative capabilities. It also defaults + to not have a root password (this is not the same as the system root). + Also, many installations default to running mysqld as the system root. + + 1. Consult the documentation that came with your system for + information on making mysqld run as an unprivleged user. + 2. You should also be sure to disable the anonymous user account and + set a password for the root user. This is accomplished using the + following commands: + +bash$ mysql mysql +mysql> DELETE FROM user WHERE user = ''; +mysql> UPDATE user SET password = password('new_password') WHERE user = 'root'; +mysql> FLUSH PRIVILEGES; + + + From this point forward you will need to use mysql -u root -p and + enter new_password when prompted when using the mysql client. + 3. If you run MySQL on the same machine as your httpd server, you + should consider disabling networking from within MySQL by adding + the following to your /etc/my.conf: + +[myslqd] +# Prevent network access to MySQL. +skip-networking + + + 4. You may also consider running MySQL, or even all of Bugzilla in a + chroot jail; however, instructions for doing that are beyond the + scope of this document. + _________________________________________________________________ + +5.6.3. Daemon Accounts - Simply blocking .*localconfig.* won't work because the QuickSearch - feature requires the web browser to be able to retrieve localconfig.js - and others may be introduced in the future (see bug 186383 for more - information. - Bugzilla provides default .htaccess files to protect the most - common Apache installations. However, you should verify these are - adequate according to the site-wide security policy of your web - server, and ensure that the .htaccess files are allowed to - "override" default permissions set in your Apache configuration - files. Covering Apache security is beyond the scope of this Guide; - please consult the Apache documentation for details. - If you are using a web server that does not support the .htaccess - control method, you are at risk! After installing, check to see if - you can view the file localconfig in your web browser (e.g.: - http://bugzilla.mozilla.org/localconfig ). If you can read the - contents of this file, your web server has not secured your - bugzilla directory properly and you must fix this problem before - deploying Bugzilla. If, however, it gives you a "Forbidden" error, - then it probably respects the .htaccess conventions and you are - good to go. - 5. When you run checksetup.pl, the script will attempt to modify - various permissions on files which Bugzilla uses. If you do not - have a webservergroup set in the localconfig file, then Bugzilla - will have to make certain files world readable and/or writable. - THIS IS INSECURE! . This means that anyone who can get access to - your system can do whatever they want to your Bugzilla - installation. + Many daemons, such as Apache's httpd and MySQL's mysqld default to + running as either "root" or "nobody". Running as "root" introduces + obvious security problems, but the problems introduced by running + everything as "nobody" may not be so obvious. Basically, if you're + running every daemon as "nobody" and one of them gets comprimised, + they all get comprimised. For this reason it is recommended that you + create a user account for each daemon. Note - This also means that if your webserver runs all cgi scripts as the - same user/group, anyone on the system who can run cgi scripts will be - able to take control of your Bugzilla installation. - On Apache, you can use .htaccess files to protect access to these - directories, as outlined in Bugs 57161 and 186383 for the - localconfig file, and Bug 65572 for adequate protection in your - data/ directory. Also, don't forget about the template/ and - Bugzilla/ directories and to allow access to the data/webdot - directory for the 192.20.225.10 IP address if you are using webdot - from research.att.com. The easiest way to accomplish this is to - set $create_htaccess to 1 in localconfig. However, the information - below is provided for those that want to know exactly what is - created. - FIX ME BEFORE RELEASE!!!!! Note the instructions which follow are - Apache-specific. If you use IIS, Netscape, or other non-Apache web - servers, please consult your system documentation for how to - secure these files from being transmitted to curious users. + You will need to set the webservergroup to the group you created for + your webserver to run as in localconfig. This will allow + ./checksetup.pl to better adjust the file permissions on your Bugzilla + install so as to not require making anything world-writable. + _________________________________________________________________ + +5.6.4. Web Server Access Controls + + There are many files that are placed in the Bugzilla directory area + that should not be accessable from the web. Because of the way + Bugzilla is currently layed out, the list of what should and should + not be accessible is rather complicated. A new installation method is + currently in the works which should solve this by allowing files that + shouldn't be accessible from the web to be placed in directory outside + the webroot. See bug 44659 for more information. + + * In the main Bugzilla directory, you should: + + Block: *.pl, *localconfig*, runtests.sh + + But allow: localconfig.js, localconfig.rdf + * In data: + + Block everything + + But allow: duplicates.rdf + * In data/webdot: + + If you use a remote webdot server: + o Block everything + o But allow *.dot only for the remote webdot server + + Otherwise, if you use a local GraphViz: + o Block everything + o But allow: *.png, *.gif, *.jpg, *.map + + And if you don't use any dot: + o Block everything + * In Bugzilla: + + Block everything + * In template: + + Block everything + + Tip + + Bugzilla ships with the ability to generate .htaccess files + instructing Apache which files should and should not be accessible. + For more information, see Section 4.4.1. + + You should test to make sure that the files mentioned above are not + accessible from the Internet, especially your localconfig file which + contains your database password. To test, simply point your web + browser at the file; for example, to test mozilla.org's installation, + we'd try to access http://bugzilla.mozilla.org/localconfig. You should + get a 403 Forbidden error. + + Caution + + Not following the instructions in this section, including testing, may + result in sensitive information being globally accessible. + + Tip + + You should check Section 4.4 to see if instructions have been included + for your web server. You should also compare those instructions with + this list to make sure everything is properly accounted for. _________________________________________________________________ 5.7. Template Customization @@ -3237,13 +3198,12 @@ Appendix A. The Bugzilla FAQ A.4.6. Email takes FOREVER to reach me from Bugzilla -- it's extremely slow. What gives? - If you are using an alternate Mail Transport Agent (MTA other than - sendmail), make sure the options given in the "processmail" and other - scripts for all instances of "sendmail" are correct for your MTA. + If you are using an alternate MTA, make sure the options given in + Bugzilla/BugMail.pm and any other place where sendmail is called from + are correct for your MTA. You should also ensure that the sendmailnow + param is set to on. - If you are using Sendmail, try enabling "sendmailnow" in - editparams.cgi. If you are using Postfix, you will also need to enable - "sendmailnow". + If you are using sendmail, try enabling sendmailnow in editparams.cgi. A.4.7. How come email from Bugzilla changes never reaches me? @@ -3914,7 +3874,8 @@ D.3. Issuezilla Issuezilla was another fork from Bugzilla, made by collab.net and hosted at tigris.org. It is also dead; the primary focus of - bug-tracking at tigris.org is their Java-based bug-tracker, Scarab. + bug-tracking at tigris.org is their Java-based bug-tracker, Section + D.4. This section last updated 27 Jul 2002 _________________________________________________________________ @@ -4417,12 +4378,21 @@ J M - mysqld - mysqld is the name of the daemon for the MySQL database. In - general, it is invoked automatically through the use of the - System V init scripts on GNU/Linux and AT&T System V-based - systems, such as Solaris and HP/UX, or through the RC scripts - on BSD-based systems. + Message Transport Agent (MTA) + A Message Transport Agent is used to control the flow of email + on a system. Many unix based systems use sendmail which is what + Bugzilla expects to find by default at /usr/sbin/sendmail. Many + other MTA's will work, but they all require that the + sendmailnow param be set to on. + + MySQL + MySQL is currently the required RDBMS for Bugzilla. MySQL can + be downloaded from http://www.mysql.com. While you should + familiarize yourself with all of the documentation, some high + points are: + + + MySQL Privilege System - Much more detailed information about + the suggestions in Section 5.6.2. P @@ -4450,6 +4420,13 @@ Q progress of bugs over their life cycle, thus the need for the "QA Contact" field in a bug. +R + + Relational DataBase Managment System (RDBMS) + A relational database management system is a database system + that stores information in tables that are related to each + other. + S SGML |