1.1. Copyright Information

This document is copyright (c) 2000-2004 by the various Bugzilla contributors who wrote it.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in Appendix D.

If you have any questions regarding this document, its copyright, or publishing this document in non-electronic form, please contact the Bugzilla Team.

1.2. Disclaimer

No liability for the contents of this document can be accepted. Follow the instructions herein at your own risk. This document may contain errors and inaccuracies that may damage your system, cause your partner to leave you, your boss to fire you, your cats to pee on your furniture and clothing, and global thermonuclear war. Proceed with caution.

Naming of particular products or brands should not be seen as endorsements, with the exception of the term "GNU/Linux". We wholeheartedly endorse the use of GNU/Linux; it is an extremely versatile, stable, and robust operating system that offers an ideal operating environment for Bugzilla.

Although the Bugzilla development team has taken great care to ensure that all exploitable bugs have been fixed, security holes surely exist in any piece of code. Great care should be taken both in the installation and usage of this software. The Bugzilla development team members assume no liability for your use of Bugzilla. You have the source code, and are responsible for auditing it yourself to ensure your security needs are met.

1.3. New Versions

This is the 2.17.7 version of The Bugzilla Guide. It is so named to match the current version of Bugzilla. This version of the guide, like its associated Bugzilla version, is a development version.

The latest version of this guide can always be found at http://www.bugzilla.org, or checked out via CVS by following the Mozilla CVS instructions and check out the mozilla/webtools/bugzilla/docs/ subtree. However, you should read the version which came with the Bugzilla release you are using.

The Bugzilla Guide, or a section of it, is also available in the following languages: German.

In addition, there are Bugzilla template localisation projects in the following languages. They may have translated documentation available: Belarusian, Brazilian Portuguese, Chinese, French, German, Korean, Russian and Spanish.

If you would like to volunteer to translate the Guide into additional languages, please contact Dave Miller.

1.4. Credits

The people listed below have made enormous contributions to the creation of this Guide, through their writing, dedicated hacking efforts, numerous e-mail and IRC support sessions, and overall excellent contribution to the Bugzilla community:

Matthew P. Barnson, Kevin Brannen, Dawn Endico, Ben FrantzDale, Eric Hanson, Tara Hernandez, Dave Lawrence, Zach Lipton, Gervase Markham, Andrew Pearson, Joe Robins, Spencer Smith, Jacob Steenhagen, Ron Teitelbaum, Terry Weissman, Martin Wulffeld.

Also, thanks are due to the members of the netscape.public.mozilla.webtools newsgroup. Without your discussions, insight, suggestions, and patches, this could never have happened.

1.5. Document Conventions

This document uses the following conventions:

Descriptions	Appearance
Warning	Don't run with scissors!
Hint	Would you like a breath mint?
Note	Dear John...
Information requiring special attention	Read this or the cat gets it.
File or directory name	filename
Command to be typed	command
Application name	application
Normal user's prompt under bash shell	bash$
Root user's prompt under bash shell	bash#
Normal user's prompt under tcsh shell	tcsh$
Environment variables	VARIABLE
Term found in the glossary	Bugzilla
Code example	<para> Beginning and end of paragraph </para>

This documentation is maintained in DocBook 4.1.2 XML format. Changes are best submitted as plain text or XML diffs, attached to a bug filed in the Bugzilla Documentation component.

2.1. Installation

If you just want to use Bugzilla, you do not need to install it. None of this chapter is relevant to you. Ask your Bugzilla administrator for the URL to access it over the web.

The Bugzilla server software is usually installed on Linux or Solaris. If you are installing on another OS, check Section 2.4 before you start your installation to see if there are any special instructions.

As an alternative to following these instructions, you may wish to try Arne Schirmacher's unofficial and unsupported Bugzilla Installer, which installs Bugzilla and all its prerequisites on Linux or Solaris systems.

This guide assumes that you have administrative access to the Bugzilla machine. It not possible to install and run Bugzilla itself without administrative access except in the very unlikely event that every single prerequisite is already installed.

The installation process may make your machine insecure for short periods of time. Make sure there is a firewall between you and the Internet.

You are strongly recommended to make a backup of your system before installing Bugzilla (and at regular intervals thereafter :-).

In outline, the installation proceeds as follows:

---

2.1.2. MySQL

Installed Version Test: mysql -V

If you don't have it and your OS doesn't provide official packages, visit http://www.mysql.com. You need MySQL version 3.23.41 or higher.

Many of the binary versions of MySQL store their data files in /var. On some Unix systems, this is part of a smaller root partition, and may not have room for your bug database. To change the data directory, you have to build MySQL from source yourself, and set it as an option to configure.

If you install from something other than a packaging/installation system (such as .rpm, .dep, .exe, or .msi) make sure the MySQL server is started when the machine boots.

---

2.1.4. Bugzilla

Download a Bugzilla tarball (or check it out from CVS) and place it in a suitable directory, writable by the default web server user (probably "nobody"). Good locations are either directly in the main web space for your web server or perhaps in /usr/local with a symbolic link from the web space.

The default Bugzilla distribution is not designed to be placed in a cgi-bin directory. This includes any directory which is configured using the ScriptAlias directive of Apache.

Once all the files are in a web accessible directory, make that directory writable by your webserver's user. This is a temporary step until you run the checksetup.pl script, which locks down your installation.

---

2.1.5. Perl Modules

Bugzilla's installation process is based on a script called checksetup.pl. The first thing it checks is whether you have appropriate versions of all the required Perl modules. The aim of this section is to pass this check. When it passes, do not run it again, but proceed to Section 2.2.

At this point, you need to su to root. You should remain as root until the end of the install. Then run:

bash# ./checksetup.pl

checksetup.pl will print out a list of the required and optional Perl modules, together with the versions (if any) installed on your machine. The list of required modules is reasonably long; however, you may already have several of them installed.

There is a meta-module called Bundle::Bugzilla, which installs all the other modules with a single command. You should use this if you are running Perl 5.6.1 or above.

The preferred way of installing Perl modules is via CPAN on Unix, or PPM on Windows (see Section 2.4.1.2). These instructions assume you are using CPAN; if for some reason you need to install the Perl modules manually, see Appendix C.

bash# perl -MCPAN -e 'install "<modulename>"'

If you using Bundle::Bugzilla, invoke the magic CPAN command on it. Otherwise, you need to work down the list of modules that checksetup.pl says are required, in the order given, invoking the command on each.

Many people complain that Perl modules will not install for them. Most times, the error messages complain that they are missing a file in "@INC". Virtually every time, this error is due to permissions being set too restrictively for you to compile Perl modules or not having the necessary Perl development libraries installed on your system. Consult your local UNIX systems administrator for help solving these permissions issues; if you are the local UNIX sysadmin, please consult the newsgroup/mailing list for further assistance or hire someone to help you out.

Here is a complete list of modules and their minimum versions. Some modules have special installation notes, which follow.

Required Perl modules:

1. AppConfig (1.52)

2. CGI (2.93)

3. Data::Dumper (any)

4. Date::Format (2.21)

5. DBI (1.32)

6. DBD::mysql (2.1010)

7. File::Spec (0.82)

8. File::Temp (any)

9. Template (2.08)

10. Text::Wrap (2001.0131)

Optional Perl modules:

1. GD (1.20) for bug charting

2. Chart::Base (0.99c) for bug charting

3. GD::Graph (any) for bug charting

4. GD::Text::Align (any) for bug charting

5. XML::Parser (any) for the XML interface

6. PatchReader (0.9.1) for pretty HTML view of patches

7. MIME::Parser (any) for the optional email interface

---

2.1.5.1. DBD::mysql

The installation process will ask you a few questions about the desired compilation target and your MySQL installation. For most of the questions the provided default will be adequate, but when asked if your desired target is the MySQL or mSQL packages, you should select the MySQL-related ones. Later you will be asked if you wish to provide backwards compatibility with the older MySQL packages; you should answer YES to this question. The default is NO.

A host of 'localhost' should be fine. A testing user of 'test', with a null password, should have sufficient access to run tests on the 'test' database which MySQL creates upon installation.

---

2.1.5.2. Template Toolkit (2.08)

When you install Template Toolkit, you'll get asked various questions about features to enable. The defaults are fine, except that it is recommended you use the high speed XS Stash of the Template Toolkit, in order to achieve best performance.

---

2.1.5.3. GD (1.20)

The GD module is only required if you want graphical reports.

The Perl GD module requires some other libraries that may or may not be installed on your system, including libpng and libgd. The full requirements are listed in the Perl GD module README. If compiling GD fails, it's probably because you're missing a required library.

The version of the GD module you need is very closely tied to the libgd version installed on your system. If you have a version 1.x of libgd the 2.x versions of the GD module won't work for you.

---

2.1.5.4. Chart::Base (0.99c)

The Chart::Base module is only required if you want graphical reports. Note that earlier versions that 0.99c used GIFs, which are no longer supported by the latest versions of GD.

---

2.1.5.5. GD::Graph (any)

The GD::Graph module is only required if you want graphical reports.

---

2.1.5.6. GD::Text::Align (any)

The GD::Text::Align module is only required if you want graphical reports.

---

2.1.5.7. XML::Parser (any)

The XML::Parser module is only required if you want to import XML bugs using the importxml.pl script. This is required to use Bugzilla's "move bugs" feature; you may also want to use it for migrating from another bug database. XML::Parser requires that the expat library is already installed on your machine.

---

2.1.5.8. MIME::Parser (any)

The MIME::Parser module is only required if you want to use the email interface located in the contrib directory.

---

2.1.5.9. PatchReader (0.9.1)

The PatchReader module is only required if you want to use Patch Viewer, a Bugzilla feature to show code patches in your web browser in a more readable form.

2.2. Configuration

Poorly-configured MySQL and Bugzilla installations have given attackers full access to systems in the past. Please take the security parts of these guidelines seriously, even for Bugzilla machines hidden away behind your firewall.

---

2.2.2. MySQL

2.2.2.1. Security

MySQL ships as insecure by default. It allows anybody to on the local machine full administrative capabilities without requiring a password; the special MySQL root account (note: this is not the same as the system root) also has no password. Also, many installations default to running mysqld as the system root.

1. To disable the anonymous user account and set a password for the root user, execute the following. The root user password should be different to the bugs user password you set in localconfig in the previous section, and also different to the password for the system root account on your machine.

   bash$ mysql mysql mysql> DELETE FROM user WHERE user = ''; mysql> UPDATE user SET password = password('new_password') WHERE user = 'root'; mysql> FLUSH PRIVILEGES;

   From this point forward, to run the mysql command-line client, you will need to type mysql -u root -p and enter new_password when prompted.

2. If you run MySQL on the same machine as your web server, you should disable remote access to MySQL by adding the following to your /etc/my.conf:

   [myslqd] # Prevent network access to MySQL. skip-networking

3. Consult the documentation that came with your system for information on making mysqld run as an unprivileged user.

4. For added security, you could also run MySQL, or even all of Bugzilla in a chroot jail; however, instructions for doing that are beyond the scope of this document.

---

2.2.2.2. Allow large attachments

You need to configure MySQL to accept large packets, if you want to have attachments larger than 64K. Add the text below to your /etc/my.conf. There is also a parameter in Bugzilla for setting the maximum allowable attachment size, (default 1MB). Bugzilla will only accept attachments up to the lower of these two sizes.

[mysqld] # Allow packets up to 1M set-variable = max_allowed_packet=1M

---

2.2.2.3. Add a user to MySQL

You need to add a new MySQL user for Bugzilla to use. (It's not safe to have Bugzilla use the MySQL root account.) The following instructions assume the defaults in localconfig; if you changed those, you need to modify the SQL command appropriately. You will need the $db_pass password you set in localconfig in Section 2.2.1.

We use an SQL GRANT command to create a "bugs" user. This also restricts the "bugs" user to operations within a database called "bugs", and only allows the account to connect from "localhost". Modify it to reflect your setup if you will be connecting from another machine or as a different user.

Run the mysql command-line client and enter:

mysql> GRANT SELECT,INSERT,UPDATE,DELETE,INDEX,ALTER,CREATE, DROP,REFERENCES ON bugs.* TO bugs@localhost IDENTIFIED BY '$db_pass'; mysql> FLUSH PRIVILEGES

If you are using MySQL 4, you need to add the LOCK TABLES and CREATE TEMPORARY TABLES permissions to the list.

---

2.2.4. Web server

Configure your web server according to the instructions in the appropriate section. The Bugzilla Team recommends Apache.

---

2.2.4.1. Apache httpd

Load httpd.conf in your editor.

Uncomment (or add) the following line. This configures Apache to run .cgi files outside the cgi-bin directory.

AddHandler cgi-script .cgi

Apache uses <Directory> directives to permit fine-grained permission setting. Add the following two lines to a <Directory> directive that applies either to the Bugzilla directory or one of its parents (e.g. the <Directory /var/www/html> directive). This allows Bugzilla's .htaccess files to override global permissions, and allows .cgi files to run in the Bugzilla directory.

Options +ExecCGI +FollowSymLinks AllowOverride Limit

Add index.cgi to the end of the DirectoryIndex line.

checksetup.pl can set tighter permissions on Bugzilla's files and directories if it knows what user the webserver runs as. Look for the User line in httpd.conf, and place that value in the $webservergroup variable in localconfig. Then rerun checksetup.pl.

---

2.2.4.2. Microsoft Internet Information Services

If you need, or for some reason even want, to use Microsoft's Internet Information Services or Personal Web Server you should be able to. You will need to configure them to know how to run CGI scripts. This is described in Microsoft Knowledge Base article Q245225 for Internet Information Services and Q231998 for Personal Web Server.

Also, and this can't be stressed enough, make sure that files such as localconfig and your data directory are secured as described in Section 2.2.4.4.

---

2.2.4.3. AOL Server

Ben FrantzDale reported success using AOL Server with Bugzilla. He reported his experience and what appears below is based on that.

AOL Server will have to be configured to run CGI scripts, please consult the documentation that came with your server for more information on how to do this.

Because AOL Server doesn't support .htaccess files, you'll have to create a TCL script. You should create an aolserver/modules/tcl/filter.tcl file (the filename shouldn't matter) with the following contents (change /bugzilla/ to the web-based path to your Bugzilla installation):

ns_register_filter preauth GET /bugzilla/localconfig filter_deny ns_register_filter preauth GET /bugzilla/localconfig~ filter_deny ns_register_filter preauth GET /bugzilla/\#localconfig\# filter_deny ns_register_filter preauth GET /bugzilla/*.pl filter_deny ns_register_filter preauth GET /bugzilla/syncshadowdb filter_deny ns_register_filter preauth GET /bugzilla/runtests.sh filter_deny ns_register_filter preauth GET /bugzilla/data/* filter_deny ns_register_filter preauth GET /bugzilla/template/* filter_deny proc filter_deny { why } { ns_log Notice "filter_deny" return "filter_return" }

This probably doesn't account for all possible editor backup files so you may wish to add some additional variations of localconfig. For more information, see bug 186383 or Bugtraq ID 6501.

If you are using webdot from research.att.com (the default configuration for the webdotbase paramater), you will need to allow access to data/webdot/*.dot for the reasearch.att.com machine. If you are using a local installation of GraphViz, you will need to allow everybody to access *.png, *.gif, *.jpg, and *.map in the data/webdot directory.

---

2.2.4.4. Web Server Access Controls

Users of Apache can skip this section because Bugzilla ships with .htaccess files which restrict access in the manner required. Users of other webservers, read on.

There are several files in the Bugzilla directory that should not be accessible from the web. You need to configure your webserver so they they aren't. Not doing this may reveal sensitive information such as database passwords.

• In the main Bugzilla directory, you should:

  • Block: *.pl, *localconfig*, runtests.sh

  • But allow: localconfig.js, localconfig.rdf

• In data:

  • Block everything

  • But allow: duplicates.rdf

• In data/webdot:

  • If you use a remote webdot server:

    • Block everything

    • But allow *.dot only for the remote webdot server

  • Otherwise, if you use a local GraphViz:

    • Block everything

    • But allow: *.png, *.gif, *.jpg, *.map

  • And if you don't use any dot:

    • Block everything

• In Bugzilla:

  • Block everything

• In template:

  • Block everything

You should test to make sure that the files mentioned above are not accessible from the Internet, especially your localconfig file which contains your database password. To test, simply point your web browser at the file; for example, to test mozilla.org's installation, we'd try to access http://bugzilla.mozilla.org/localconfig. You should get a 403 Forbidden error.

2.3. Optional Additional Configuration

Bugzilla has a number of optional features. This section describes how to configure or enable them.

bash# crontab -e

5 0 * * * cd <your-bugzilla-directory> ; ./collectstats.pl

55 0 * * * cd <your-bugzilla-directory> ; ./whineatnews.pl

---

2.3.5. LDAP Authentication

LDAP authentication is a module for Bugzilla's plugin authentication architecture.

The existing authentication scheme for Bugzilla uses email addresses as the primary user ID, and a password to authenticate that user. All places within Bugzilla where you need to deal with user ID (e.g assigning a bug) use the email address. The LDAP authentication builds on top of this scheme, rather than replacing it. The initial log in is done with a username and password for the LDAP directory. This then fetches the email address from LDAP and authenticates seamlessly in the standard Bugzilla authentication scheme using this email address. If an account for this address already exists in your Bugzilla system, it will log in to that account. If no account for that email address exists, one is created at the time of login. (In this case, Bugzilla will attempt to use the "displayName" or "cn" attribute to determine the user's full name.) After authentication, all other user-related tasks are still handled by email address, not LDAP username. You still assign bugs by email address, query on users by email address, etc.

Because the Bugzilla account is not created until the first time a user logs in, a user who has not yet logged is unknown to Bugzilla. This means they cannot be used as an assignee or QA contact (default or otherwise), added to any cc list, or any other such operation. One possible workaround is the bugzilla_ldapsync.rb script in the contrib directory. Another possible solution is fixing bug 201069.

Parameters required to use LDAP Authentication:

loginmethod

This parameter should be set to "LDAP" only if you will be using an LDAP directory for authentication. If you set this param to "LDAP" but fail to set up the other parameters listed below you will not be able to log back in to Bugzilla one you log out. If this happens to you, you will need to manually edit data/params and set loginmethod to "DB".

LDAPserver

This parameter should be set to the name (and optionally the port) of your LDAP server. If no port is specified, it assumes the default LDAP port of 389.

Ex. "ldap.company.com" or "ldap.company.com:3268"

LDAPbinddn [Optional]

Some LDAP servers will not allow an anonymous bind to search the directory. If this is the case with your configuration you should set the LDAPbinddn parameter to the user account Bugzilla should use instead of the anonymous bind.

Ex. "cn=default,cn=user:password"

LDAPBaseDN

The LDAPBaseDN parameter should be set to the location in your LDAP tree that you would like to search for email addresses. Your uids should be unique under the DN specified here.

Ex. "ou=People,o=Company"

LDAPuidattribute

The LDAPuidattribute parameter should be set to the attribute which contains the unique UID of your users. The value retrieved from this attribute will be used when attempting to bind as the user to confirm their password.

Ex. "uid"

LDAPmailattribute

The LDAPmailattribute parameter should be the name of the attribute which contains the email address your users will enter into the Bugzilla login boxes.

Ex. "mail"

2.4. OS-Specific Installation Notes

Many aspects of the Bugzilla installation can be affected by the the operating system you choose to install it on. Sometimes it can be made easier and others more difficult. This section will attempt to help you understand both the difficulties of running on specific operating systems and the utilities available to make it easier.

If you have anything to add or notes for an operating system not covered, please file a bug in Bugzilla Documentation.

---

2.4.1. Microsoft Windows

Making Bugzilla work on Windows is still a painful processes. The Bugzilla Team is working to make it easier, but that goal is not considered a top priority. If you wish to run Bugzilla, we still recommend doing so on a Unix based system such as GNU/Linux. As of this writing, all members of the Bugzilla team and all known large installations run on Unix based systems.

If after hearing all that, you have enough pain tolerance to attempt installing Bugzilla on Win32, here are some pointers. Because this is a development version of the guide, these instructions are subject to change without notice. In fact, the Bugzilla Team hopes to have Bugzilla reasonably close to "out of the box" compatibility with Windows by the 2.18 release.

---

2.4.1.1. Win32 Perl

Perl for Windows can be obtained from ActiveState. You should be able to find a compiled binary at http://aspn.activestate.com/ASPN/Downloads/ActivePerl/.

---

2.4.1.2. Perl Modules on Win32

Bugzilla on Windows requires the same perl modules found in Section 2.1.5. The main difference is that windows uses PPM instead of CPAN.

C:\perl> ppm <module name>

The above syntax should work for all modules with the exception of Template Toolkit. The Template Toolkit website suggests using the instructions on OpenInteract's website.

---

2.4.1.3. Code changes required to run on win32

As Bugzilla still doesn't run "out of the box" on Windows, code has to be modified. This section lists the required changes.

---

2.4.1.3.1. Changes to checksetup.pl

In checksetup.pl, the line reading:

my $mysql_binaries = `which mysql`;

to

my $mysql_binaries = "D:\\mysql\\bin\\mysql";

And you'll also need to change:

my $webservergid = getgrnam($my_webservergroup)

to

my $webservergid = '8'

---

2.4.1.3.2. Changes to BugMail.pm

To make bug email work on Win32 (until bug 84876 lands), the simplest way is to have the Net::SMTP Perl module installed and change this:

open(SENDMAIL, "|/usr/lib/sendmail $sendmailparam -t -i") || die "Can't open sendmail"; print SENDMAIL trim($msg) . "\n"; close SENDMAIL;

to

use Net::SMTP; my $smtp_server = 'smtp.mycompany.com'; # change this # Use die on error, so that the mail will be in the 'unsent mails' and # can be sent from the sanity check page. my $smtp = Net::SMTP->new($smtp_server) || die 'Cannot connect to server \'$smtp_server\''; $smtp->mail('bugzilla-daemon@mycompany.com'); # change this $smtp->to($person); $smtp->data(); $smtp->datasend($msg); $smtp->dataend(); $smtp->quit;

Don't forget to change the name of your SMTP server and the domain of the sending email address (after the '@') in the above lines of code.

---

2.4.1.4. Serving the web pages

As is the case on Unix based systems, any web server should be able to handle Bugzilla; however, the Bugzilla Team still recommends Apache whenever asked. No matter what web server you choose, be sure to pay attention to the security notes in Section 2.2.4.4. More information on configuring specific web servers can be found in Section 2.2.4.

If using Apache on windows, you can set the ScriptInterpreterSource directive in your Apache config to avoid having to modify the first line of every script to contain your path to perl instead of /usr/bin/perl.

---

2.4.2. Mac OS X

Apple did not include the GD library with Mac OS X. Bugzilla needs this for bug graphs.

You can install it using a program called Fink, which is similar in nature to the CPAN installer, but installs common GNU utilities. Fink is available from http://sourceforge.net/projects/fink/.

Follow the instructions for setting up Fink. Once it's installed, you'll want to use it to install the gd2 package.

It will prompt you for a number of dependencies, type 'y' and hit enter to install all of the dependencies and then watch it work. You will then be able to use CPAN to install the GD Perl module.

To prevent creating conflicts with the software that Apple installs by default, Fink creates its own directory tree at /sw where it installs most of the software that it installs. This means your libraries and headers be at /sw/lib and /sw/include instead of /usr/lib and /usr/local/include. When the Perl module config script asks where your libgd is, be sure to tell it /sw/lib.

Also available via Fink is expat. After using fink to install the expat package you will be able to install XML::Parser using CPAN. There is one caveat. Unlike recent versions of the GD module, XML::Parser doesn't prompt for the location of the required libraries. When using CPAN, you will need to use the following command sequence:

# perl -MCPAN -e'look XML::Parser' # perl Makefile.PL EXPATLIBPATH=/sw/lib EXPATINCPATH=/sw/include # make; make test; make install # exit

The look command will download the module and spawn a new shell with the extracted files as the current working directory. The exit command will return you to your original shell.

You should watch the output from these make commands, especially "make test" as errors may prevent XML::Parser from functioning correctly with Bugzilla.

bash# urpmi perl-mysql
bash# urpmi perl-chart
bash# urpmi perl-gd
bash# urpmi perl-MailTools             
bash# urpmi apache-modules
      

2.5. Troubleshooting

This section gives solutions to common Bugzilla installation problems. If none of the section headings seems to match your problem, read the general advice.

 DBD::Sponge::db prepare failed: Cannot determine NUM_OF_FIELDS at D:/Perl/site/lib/DBD/mysql.pm line 248.
  SV = NULL(0x0) at 0x20fc444
  REFCNT = 1
  FLAGS = (PADBUSY,PADMY)

 my $numFields;
 if ($attribs->{'NUM_OF_FIELDS'}) {
     $numFields = $attribs->{'NUM_OF_FIELDS'};
 } elsif ($attribs->{'NAME'}) {
     $numFields = @{$attribs->{NAME}};

 my $numFields;
 if ($attribs->{'NUM_OF_FIELDS'}) {
     $numFields = $attribs->{'NUM_OF_FIELDS'};
 } elsif ($attribs->{'NAMES'}) {
     $numFields = @{$attribs->{NAMES}};

Your vendor has not defined Fcntl macro O_NOINHERIT, used 
at /usr/lib/perl5/site_perl/5.6.0/File/Temp.pm line 208.

Your vendor has not defined Fcntl macro O_EXLOCK, used 
at /usr/lib/perl5/site_perl/5.6.0/File/Temp.pm line 210.

Your vendor has not defined Fcntl macro O_TEMPORARY, used 
at /usr/lib/perl5/site_perl/5.6.0/File/Temp.pm line 233.

--- File/Temp.pm.orig   Thu Feb  6 16:26:00 2003
+++ File/Temp.pm        Thu Feb  6 16:26:23 2003
@@ -205,6 +205,7 @@
     # eg CGI::Carp
     local $SIG{__DIE__} = sub {};
     local $SIG{__WARN__} = sub {};
+    local *CORE::GLOBAL::die = sub {};
     $bit = &$func();
     1;
   };
@@ -226,6 +227,7 @@
     # eg CGI::Carp
     local $SIG{__DIE__} = sub {};
     local $SIG{__WARN__} = sub {};
+    local *CORE::GLOBAL::die = sub {};
     $bit = &$func();
     1;
   };

3.1. Bugzilla Configuration

Bugzilla is configured by changing various parameters, accessed from the "Edit parameters" link in the page footer. Here are some of the key parameters on that page. You should run down this list and set them appropriately after installing Bugzilla.

3.2. User Administration

3.2.1. Creating the Default User

When you first run checksetup.pl after installing Bugzilla, it will prompt you for the administrative username (email address) and password for this "super user". If for some reason you delete the "super user" account, re-running checksetup.pl will again prompt you for this username and password.

If you wish to add more administrative users, add them to the "admin" group and, optionally, add edit the tweakparams, editusers, creategroups, editcomponents, and editkeywords groups to add the entire admin group to those groups.

3.3. Products

Products are the broadest category in Bugzilla, and tend to represent real-world shipping products. E.g. if your company makes computer games, you should have one product per game, perhaps a "Common" product for units of technology used in multiple games, and maybe a few special products (Website, Administration...)

Many of Bugzilla's settings are configurable on a per-product basis. The number of "votes" available to users is set per-product, as is the number of votes required to move a bug automatically from the UNCONFIRMED status to the NEW status.

To create a new product:

1. Select "products" from the footer

2. Select the "Add" link in the bottom right

3. Enter the name of the product and a description. The Description field may contain HTML.

Don't worry about the "Closed for bug entry", "Maximum Votes per person", "Maximum votes a person can put on a single bug", "Number of votes a bug in this Product needs to automatically get out of the UNCOMFIRMED state", and "Version" options yet. We'll cover those in a few moments.

3.4. Components

Components are subsections of a Product. E.g. the computer game you are designing may have a "UI" component, an "API" component, a "Sound System" component, and a "Plugins" component, each overseen by a different programmer. It often makes sense to divide Components in Bugzilla according to the natural divisions of responsibility within your Product or company.

Each component has a owner and (if you turned it on in the parameters), a QA Contact. The owner should be the primary person who fixes bugs in that component. The QA Contact should be the person who will ensure these bugs are completely fixed. The Owner, QA Contact, and Reporter will get email when new bugs are created in this Component and when these bugs change. Default Owner and Default QA Contact fields only dictate the default assignments; these can be changed on bug submission, or at any later point in a bug's life.

To create a new Component:

1. Select the "Edit components" link from the "Edit product" page

2. Select the "Add" link in the bottom right.

3. Fill out the "Component" field, a short "Description", the "Initial Owner" and "Initial QA Contact" (if enabled.) The Component and Description fields may contain HTML; the "Initial Owner" field must be a login name already existing in the database.

3.5. Versions

Versions are the revisions of the product, such as "Flinders 3.1", "Flinders 95", and "Flinders 2000". Version is not a multi-select field; the usual practice is to select the earliest version known to have the bug.

To create and edit Versions:

1. From the "Edit product" screen, select "Edit Versions"

2. You will notice that the product already has the default version "undefined". Click the "Add" link in the bottom right.

3. Enter the name of the Version. This field takes text only. Then click the "Add" button.

3.6. Milestones

Milestones are "targets" that you plan to get a bug fixed by. For example, you have a bug that you plan to fix for your 3.0 release, it would be assigned the milestone of 3.0.

Milestone options will only appear for a Product if you turned on the "usetargetmilestone" Param in the "Edit Parameters" screen.

To create new Milestones, set Default Milestones, and set Milestone URL:

1. Select "Edit milestones" from the "Edit product" page.

2. Select "Add" in the bottom right corner. text

3. Enter the name of the Milestone in the "Milestone" field. You can optionally set the "sortkey", which is a positive or negative number (-255 to 255) that defines where in the list this particular milestone appears. This is because milestones often do not occur in alphanumeric order For example, "Future" might be after "Release 1.2". Select "Add".

4. From the Edit product screen, you can enter the URL of a page which gives information about your milestones and what they mean.

3.7. Voting

Voting allows users to be given a pot of votes which they can allocate to bugs, to indicate that they'd like them fixed. This allows developers to gauge user need for a particular enhancement or bugfix. By allowing bugs with a certain number of votes to automatically move from "UNCONFIRMED" to "NEW", users of the bug system can help high-priority bugs garner attention so they don't sit for a long time awaiting triage.

To modify Voting settings:

1. Navigate to the "Edit product" screen for the Product you wish to modify

2. Maximum Votes per person: Setting this field to "0" disables voting.

3. Maximum Votes a person can put on a single bug: It should probably be some number lower than the "Maximum votes per person". Don't set this field to "0" if "Maximum votes per person" is non-zero; that doesn't make any sense.

4. Number of votes a bug in this product needs to automatically get out of the UNCONFIRMED state: Setting this field to "0" disables the automatic move of bugs from UNCONFIRMED to NEW.

5. Once you have adjusted the values to your preference, click "Update".

3.8. Groups and Group Security

Groups allow the administrator to isolate bugs or products that should only be seen by certain people. The association between products and groups is controlled from the product edit page under "Edit Group Controls."

If the makeproductgroups param is on, a new group will be automatically created for every new product.

On the product edit page, there is a page to edit the "Group Controls" for a product and determine which groups are applicable, default, and mandatory for each product as well as controlling entry for each product and being able to set bugs in a product to be totally read-only unless some group restrictions are met.

For each group, it is possible to specify if membership in that group is...

1. required for bug entry,

2. Not applicable to this product(NA), a possible restriction for a member of the group to place on a bug in this product(Shown), a default restriction for a member of the group to place on a bug in this product(Default), or a mandatory restriction to be placed on bugs in this product(Mandatory).

3. Not applicable by non-members to this product(NA), a possible restriction for a non-member of the group to place on a bug in this product(Shown), a default restriction for a non-member of the group to place on a bug in this product(Default), or a mandatory restriction to be placed on bugs in this product when entered by a non-member(Mandatory).

4. required in order to make any change to bugs in this product including comments.

To create Groups:

1. Select the "groups" link in the footer.

2. Take a moment to understand the instructions on the "Edit Groups" screen, then select the "Add Group" link.

3. Fill out the "Group", "Description", and "User RegExp" fields. "User RegExp" allows you to automatically place all users who fulfill the Regular Expression into the new group. When you have finished, click "Add".

   If specifying a domain in the regexp, make sure you end the regexp with a $. Otherwise, when granting access to "@mycompany\.com", you will allow access to 'badperson@mycompany.com.cracker.net'. You need to use '@mycompany\.com$' as the regexp.

4. After you add your new group, edit the new group. On the edit page, you can specify other groups that should be included in this group and which groups should be permitted to add and delete users from this group.

Note that group permissions are such that you need to be a member of all the groups a bug is in, for whatever reason, to see that bug. Similarly, you must be a member of all of the entry groups for a product to add bugs to a product and you must be a member of all of the canedit groups for a product in order to make any change to bugs in that product.

3.9. Upgrading to New Releases

Upgrading is a one-way process. You should backup your database and current Bugzilla directory before attempting the upgrade. If you wish to revert to the old Bugzilla version for any reason, you will have to restore from these backups.

Upgrading Bugzilla is something we all want to do from time to time, be it to get new features or pick up the latest security fix. How easy it is to update depends on a few factors.

• If the new version is a revision or a new point release

• How many, if any, local changes have been made

There are also three different methods to upgrade your installation.

1. Using CVS (Example 3-1)

2. Downloading a new tarball (Example 3-2)

3. Applying the relevant patches (Example 3-3)

Which options are available to you may depend on how large a jump you are making and/or your network configuration.

Revisions are normally released to fix security vulnerabilities and are distinguished by an increase in the third number. For example, when 2.16.2 was released, it was a revision to 2.16.1.

Point releases are normally released when the Bugzilla team feels that there has been a significant amount of progress made between the last point release and the current time. These are often proceeded by a stabilization period and release candidates, however the use of development versions or release candidates is beyond the scope of this document. Point releases can be distinguished by an increase in the second number, or minor version. For example, 2.16.2 is a newer point release than 2.14.5.

The examples in this section are written as if you were updating to version 2.16.2. The procedures are the same regardless if you are updating to a new point release or a new revision. However, the chance of running into trouble increases when upgrading to a new point release, escpecially if you've made local changes.

These examples also assume that your Bugzilla installation is at /var/www/html/bugzilla. If that is not the case, simply substitute the proper paths where appropriate.

Example 3-1. Upgrading using CVS

Every release of Bugzilla, whether it is a revision or a point release, is tagged in CVS. Also, every tarball we have distributed since version 2.12 has been primed for using CVS. This does, however, require that you are able to access cvs-mirror.mozilla.org on port 2401.

If you can do this, updating using CVS is probably the most painless method, especially if you have a lot of local changes.

bash$ cd /var/www/html/bugzilla bash$ cvs login Logging in to :pserver:anonymous@cvs-mirror.mozilla.org:2401/cvsroot CVS password: anonymous bash$ cvs -q update -r BUGZILLA-2_16_2 -dP P checksetup.pl P collectstats.pl P globals.pl P docs/rel_notes.txt P template/en/default/list/quips.html.tmpl

If a line in the output from cvs update begins with a C that represents a file with local changes that CVS was unable to properly merge. You need to resolve these conflicts manually before Bugzilla (or at least the portion using that file) will be usable.

You also need to run ./checksetup.pl before your Bugzilla upgrade will be complete.

Example 3-2. Upgrading using the tarball

If you are unable or unwilling to use CVS, another option that's always available is to download the latest tarball. This is the most difficult option to use, especially if you have local changes.

bash$ cd /var/www/html bash$ wget ftp://ftp.mozilla.org/pub/webtools/bugzilla-2.16.2.tar.gz Output omitted bash$ tar xzvf bugzilla-2.16.2.tar.gz bugzilla-2.16.2/ bugzilla-2.16.2/.cvsignore bugzilla-2.16.2/1x1.gif Output truncated bash$ cd bugzilla-2.16.2 bash$ cp ../bugzilla/localconfig* . bash$ cp -r ../bugzilla/data . bash$ cd .. bash$ mv bugzilla bugzilla.old bash$ mv bugzilla-2.16.2 bugzilla bash$ cd bugzilla bash$ ./checksetup.pl Output omitted

The cp commands both end with periods which is a very important detail, it tells the shell that the destination directory is the current working directory. Also, the period at the beginning of the ./checksetup.pl is important and can not be omitted.

You will now have to reapply any changes you have made to your local installation manually.

Example 3-3. Upgrading using patches

The Bugzilla team will normally make a patch file available for revisions to go from the most recent revision to the new one. You could also read the release notes and grab the patches attached to the mentioned bug, but it is safer to use the released patch file as sometimes patches get changed before they get checked in. It is also theoretically possible to scour the fixed bug list and pick and choose which patches to apply from a point release, but this is not recommended either as what you'll end up with is a hodge podge Bugzilla that isn't really any version. This would also make it more difficult to upgrade in the future.

bash$ cd /var/www/html/bugzilla bash$ wget ftp://ftp.mozilla.org/pub/webtools/bugzilla-2.16.1-to-2.16.2.diff.gz Output omitted bash$ gunzip bugzilla-2.16.1-to-2.16.2.diff.gz bash$ patch -p1 < bugzilla-2.16.1-to-2.16.2.diff patching file checksetup.pl patching file collectstats.pl patching file globals.pl

If you do this, beware that this doesn't change the entires in your CVS directory so it may make updates using CVS (Example 3-1) more difficult in the future.

4.1. Template Customization

Administrators can configure the look and feel of Bugzilla without having to edit Perl files or face the nightmare of massive merge conflicts when they upgrade to a newer version in the future.

Templatization also makes localized versions of Bugzilla possible, for the first time. It's possible to have Bugzilla's UI language determined by the user's browser. More information is available in Section 4.1.5.

---

4.1.1. What to Edit

The template directory structure is that there's a top level directory, template, which contains a directory for each installed localization. The default English templates are therefore in en. Underneath that, there is the default directory and optionally the custom directory. The default directory contains all the templates shipped with Bugzilla, whereas the custom directory does not exist at first and must be created if you want to use it.

There are two different ways of editing Bugzilla's templates, and which you use depends mainly on the method you plan to use to upgrade Bugzilla. The first method of making customizations is to directly edit the templates in template/en/default. This is probably the best method for small changes if you are going to use the CVS method of upgrading, because if you then execute a cvs update, any template fixes will get automagically merged into your modified versions.

If you use this method, your installation will break if CVS conflicts occur.

The other method is to copy the templates to be modified into a mirrored directory structure under template/en/custom. The templates in this directory automatically override those in default. This is the technique you need to use if you use the overwriting method of upgrade, because otherwise your changes will be lost. This method is also better if you are using the CVS method of upgrading and are going to make major changes, because it is guaranteed that the contents of this directory will not be touched during an upgrade, and you can then decide whether to continue using your own templates, or make the effort to merge your changes into the new versions by hand.

If you use this method, your installation may break if incompatible changes are made to the template interface. If such changes are made they will be documented in the release notes, provided you are using a stable release of Bugzilla. If you use using unstable code, you will need to deal with this one yourself, although if possible the changes will be mentioned before they occur in the deprecations section of the previous stable release's release notes.

Don't directly edit the compiled templates in data/template/* - your changes will be lost when Template Toolkit recompiles them.

It is recommended that you run ./checksetup.pl after any template edits, especially if you've created a new file in the custom directory.

---

4.1.2. How To Edit Templates

If you are making template changes that you intend on submitting back for inclusion in standard Bugzilla, you should read the relevant sections of the Developers' Guide.

The syntax of the Template Toolkit language is beyond the scope of this guide. It's reasonably easy to pick up by looking at the current templates; or, you can read the manual, available on the Template Toolkit home page.

One thing you should take particular care about is the need to properly HTML filter data that has been passed into the template. This means that if the data can possibly contain special HTML characters such as <, and the data was not intended to be HTML, they need to be converted to entity form, ie &lt;. You use the 'html' filter in the Template Toolkit to do this. If you forget, you may open up your installation to cross-site scripting attacks.

Also note that Bugzilla adds a few filters of its own, that are not in standard Template Toolkit. In particular, the 'url_quote' filter can convert characters that are illegal or have special meaning in URLs, such as &, to the encoded form, ie %26. This actually encodes most characters (but not the common ones such as letters and numbers and so on), including the HTML-special characters, so there's never a need to HTML filter afterwards.

Editing templates is a good way of doing a "poor man's custom fields". For example, if you don't use the Status Whiteboard, but want to have a free-form text entry box for "Build Identifier", then you can just edit the templates to change the field labels. It's still be called status_whiteboard internally, but your users don't need to know that.

4.2. Template Hooks

Template hooks are a way for extensions to Bugzilla to insert code into the standard Bugzilla templates without modifying the template files themselves. The hooks mechanism defines a consistent API for extending the standard templates in a way that cleanly separates standard code from extension code. Hooks reduce merge conflicts and make it easier to write extensions that work across multiple versions of Bugzilla, making upgrading a Bugzilla installation with installed extensions easier.

A template hook is just a named place in a standard template file where extension template files for that hook get processed. Each hook has a corresponding directory in the Bugzilla directory tree. Hooking an extension template to a hook is as simple as putting the extension file into the hook's directory. When Bugzilla processes the standard template and reaches the hook, it will process all extension templates in the hook's directory. The hooks themselves can be added into any standard template upon request by extension authors.

To use hooks to extend a Bugzilla template, first make sure there is a hook at the appropriate place within the template you want to extend. Hooks appear in the standard Bugzilla templates as a single directive in the format [% Hook.process("name") %], where name is the unique (within that template) name of the hook.

If you aren't sure which template you want to extend or just want to browse the available hooks, either use your favorite multi-file search tool (e.g. grep) to search the standard templates for occurrences of Hook.process or browse the directory tree in BUGZILLA_ROOT/template/en/extension/hook/, which contains a directory for each hook in the following location:

BUGZILLA_ROOT/template/en/extension/hook/PATH_TO_STANDARD_TEMPLATE/STANDARD_TEMPLATE_NAME/HOOK_NAME/

If there is no hook at the appropriate place within the Bugzilla template you want to extend, file a bug requesting one, specifying:

The Bugzilla reviewers will promptly review each hook request, name the hook, add it to the template, check the new version of the template into CVS, and create the corresponding directory in BUGZILLA_ROOT/template/en/extension/hook/.

You may optionally attach a patch to the bug which implements the hook and check it in yourself after receiving approval from a Bugzilla reviewer. The developers may suggest changes to the location of the hook based on their analysis of your needs or so the hook can satisfy the needs of multiple extensions, but the process of getting hooks approved and checked in is not as stringent as the process for general changes to Bugzilla, and any extension, whether released or still in development, can have hooks added to meet their needs.

After making sure the hook you need exists (or getting it added if not), add your extension template to the directory within the Bugzilla directory tree corresponding to the hook.

That's it! Now, when the standard template containing the hook is processed, your extension template will be processed at the point where the hook appears.

For example, let's say you have an extension named Projman that adds project management capabilities to Bugzilla. Projman has an administration interface edit-projects.cgi, and you want to add a link to it into the navigation bar at the bottom of every Bugzilla page for those users who are authorized to administer projects.

The navigation bar is generated by the template file useful-links.html.tmpl, which is located in the global/ subdirectory on the standard Bugzilla template path BUGZILLA_ROOT/template/en/default/. Looking in useful-links.html.tmpl, you find the following hook at the end of the list of standard Bugzilla administration links:

...
    [% ', <a href="editkeywords.cgi">keywords</a>' 
                                              IF user.groups.editkeywords %]
    [% Hook.process("edit") %]
...

The corresponding directory for this hook is BUGZILLA_ROOT/template/en/extension/hook/global/useful-links.html.tmpl/edit/.

You put a template named projman-edit-projects.html.tmpl into that directory with the following content:

...[% ', <a href="edit-projects.cgi">projects</a>' IF user.groups.projman_admins %]

Voila! The link now appears after the other administration links in the navigation bar for users in the projman_admins group.

Notes:

• You may want to prefix your extension template names with the name of your extension, e.g. projman-foo.html.tmpl, so they do not conflict with the names of templates installed by other extensions.

• If your extension includes entirely new templates in addition to extensions of standard templates, it should install those new templates into an extension-specific subdirectory of the BUGZILLA_ROOT/template/en/extension/ directory. The extension/ directory, like the default/ and custom/ directories, is part of the template search path, so putting templates there enables them to be found by the template processor.

  The template processor looks for templates first in the custom/ directory (i.e. templates added by the specific installation), then in the extension/ directory (i.e. templates added by extensions), and finally in the default/ directory (i.e. the standard Bugzilla templates). Thus extension templates can override standard templates, but installation-specific templates override both.

  Note that overriding standard templates with extension templates gives you great power but also makes upgrading an installation harder. As with custom templates, we recommend using this functionality sparingly and only when absolutely necessary.

• Installation customizers can also take advantage of hooks when adding code to a Bugzilla template. To do so, create directories in BUGZILLA_ROOT/template/en/custom/hook/ equivalent to the directories in BUGZILLA_ROOT/template/en/extension/hook/ for the hooks you want to use, then place your customization templates into those directories.

  Obviously this method of customizing Bugzilla only lets you add code to the standard templates; you cannot change the existing code. Nevertheless, for those customizations that only add code, this method can reduce conflicts when merging changes, making upgrading your customized Bugzilla installation easier.

4.3. Customizing Who Can Change What

This feature should be considered experimental; the Bugzilla code you will be changing is not stable, and could change or move between versions. Be aware that if you make modifications as outlined here, you may have to re-make them or port them if Bugzilla changes internally between versions, and you upgrade.

Companies often have rules about which employees, or classes of employees, are allowed to change certain things in the bug system. For example, only the bug's designated QA Contact may be allowed to VERIFY the bug. Bugzilla has been designed to make it easy for you to write your own custom rules to define who is allowed to make what sorts of value transition.

For maximum flexibility, customizing this means editing Bugzilla's Perl code. This gives the administrator complete control over exactly who is allowed to do what. The relevant function is called CheckCanChangeField(), and is found in process_bug.cgi in your Bugzilla directory. If you open that file and grep for "sub CheckCanChangeField", you'll find it.

This function has been carefully commented to allow you to see exactly how it works, and give you an idea of how to make changes to it. Certain marked sections should not be changed - these are the "plumbing" which makes the rest of the function work. In between those sections, you'll find snippets of code like:

# Allow the owner to change anything. if ($ownerid eq $whoid) { return 1; }

It's fairly obvious what this piece of code does.

So, how does one go about changing this function? Well, simple changes can be made just be removing pieces - for example, if you wanted to prevent any user adding a comment to a bug, just remove the lines marked "Allow anyone to change comments." And if you want the reporter to have no special rights on bugs they have filed, just remove the entire section which refers to him.

More complex customizations are not much harder. Basically, you add a check in the right place in the function, i.e. after all the variables you are using have been set up. So, don't look at $ownerid before $ownerid has been obtained from the database. You can either add a positive check, which returns 1 (allow) if certain conditions are true, or a negative check, which returns 0 (deny.) E.g.:

if ($field eq "qacontact") { if (Bugzilla->user->groups("quality_assurance")) { return 1; } else { return 0; } }

This says that only users in the group "quality_assurance" can change the QA Contact field of a bug. Getting more weird:

if (($field eq "priority") && (Bugzilla->user->email =~ /.*\@example\.com$/)) { if ($oldvalue eq "P1") { return 1; } else { return 0; } }

This says that if the user is trying to change the priority field, and their email address is @example.com, they can only do so if the old value of the field was "P1". Not very useful, but illustrative.

For a list of possible field names, look in data/versioncache for the list called @::log_columns. If you need help writing custom rules for your organization, ask in the newsgroup.

4.4. Modifying Your Running System

Bugzilla optimizes database lookups by storing all relatively static information in the versioncache file, located in the data/ subdirectory under your installation directory.

If you make a change to the structural data in your database (the versions table for example), or to the "constants" encoded in defparams.pl, you will need to remove the cached content from the data directory (by doing a "rm data/versioncache" ), or your changes won't show up.

versioncache gets automatically regenerated whenever it's more than an hour old, so Bugzilla will eventually notice your changes by itself, but generally you want it to notice right away, so that you can test things.

4.5. MySQL Bugzilla Database Introduction

This information comes straight from my life. I was forced to learn how Bugzilla organizes database because of nitpicky requests from users for tiny changes in wording, rather than having people re-educate themselves or figure out how to work our procedures around the tool. It sucks, but it can and will happen to you, so learn how the schema works and deal with it when it comes.

So, here you are with your brand-new installation of Bugzilla. You've got MySQL set up, Apache working right, Perl DBI and DBD talking to the database flawlessly. Maybe you've even entered a few test bugs to make sure email's working; people seem to be notified of new bugs and changes, and you can enter and edit bugs to your heart's content. Perhaps you've gone through the trouble of setting up a gateway for people to submit bugs to your database via email, have had a few people test it, and received rave reviews from your beta testers.

What's the next thing you do? Outline a training strategy for your development team, of course, and bring them up to speed on the new tool you've labored over for hours.

Your first training session starts off very well! You have a captive audience which seems enraptured by the efficiency embodied in this thing called "Bugzilla". You are caught up describing the nifty features, how people can save favorite queries in the database, set them up as headers and footers on their pages, customize their layouts, generate reports, track status with greater efficiency than ever before, leap tall buildings with a single bound and rescue Jane from the clutches of Certain Death!

But Certain Death speaks up -- a tiny voice, from the dark corners of the conference room. "I have a concern," the voice hisses from the darkness, "about the use of the word 'verified'."

The room, previously filled with happy chatter, lapses into reverential silence as Certain Death (better known as the Vice President of Software Engineering) continues. "You see, for two years we've used the word 'verified' to indicate that a developer or quality assurance engineer has confirmed that, in fact, a bug is valid. I don't want to lose two years of training to a new software product. You need to change the bug status of 'verified' to 'approved' as soon as possible. To avoid confusion, of course."

Oh no! Terror strikes your heart, as you find yourself mumbling "yes, yes, I don't think that would be a problem," You review the changes with Certain Death, and continue to jabber on, "no, it's not too big a change. I mean, we have the source code, right? You know, 'Use the Source, Luke' and all that... no problem," All the while you quiver inside like a beached jellyfish bubbling, burbling, and boiling on a hot Jamaican sand dune...

Thus begins your adventure into the heart of Bugzilla. You've been forced to learn about non-portable enum() fields, varchar columns, and tinyint definitions. The Adventure Awaits You!

4.6. Integrating Bugzilla with Third-Party Tools

5.1. Introduction

This section contains information for end-users of Bugzilla. There is a Bugzilla test installation, called Landfill, which you are welcome to play with (if it's up.) However, it does not necessarily have all Bugzilla features enabled, and runs an up-to-the-minute version, so some things may not quite work as this document describes.

5.2. Create a Bugzilla Account

If you want to use Bugzilla, first you need to create an account. Consult with the administrator responsible for your installation of Bugzilla for the URL you should use to access it. If you're test-driving Bugzilla, use this URL: http://landfill.bugzilla.org/bugzilla-tip/.

1. Click the "Open a new Bugzilla account" link, enter your email address and, optionally, your name in the spaces provided, then click "Create Account" .

2. Within moments, you should receive an email to the address you provided, which contains your login name (generally the same as the email address), and a password. This password is randomly generated, but can be changed to something more memorable.

3. Click the "Log In" link in the footer at the bottom of the page in your browser, enter your email address and password into the spaces provided, and click "Login".

You are now logged in. Bugzilla uses cookies to remember you are logged in so, unless you have cookies disabled or your IP address changes, you should not have to log in again.

5.3. Anatomy of a Bug

The core of Bugzilla is the screen which displays a particular bug. It's a good place to explain some Bugzilla concepts. Bug 1 on Landfill is a good example. Note that the labels for most fields are hyperlinks; clicking them will take you to context-sensitive help on that particular field. Fields marked * may not be present on every installation of Bugzilla.

1. Product and Component: Bugs are divided up by Product and Component, with a Product having one or more Components in it. For example, bugzilla.mozilla.org's "Bugzilla" Product is composed of several Components:

   Administration: Administration of a Bugzilla installation.

   Bugzilla-General: Anything that doesn't fit in the other components, or spans multiple components.

   Creating/Changing Bugs: Creating, changing, and viewing bugs.

   Documentation: The Bugzilla documentation, including The Bugzilla Guide.

   Email: Anything to do with email sent by Bugzilla.

   Installation: The installation process of Bugzilla.

   Query/Buglist: Anything to do with searching for bugs and viewing the buglists.

   Reporting/Charting: Getting reports from Bugzilla.

   User Accounts: Anything about managing a user account from the user's perspective. Saved queries, creating accounts, changing passwords, logging in, etc.

   User Interface: General issues having to do with the user interface cosmetics (not functionality) including cosmetic issues, HTML templates, etc.

2. Status and Resolution: These define exactly what state the bug is in - from not even being confirmed as a bug, through to being fixed and the fix confirmed by Quality Assurance. The different possible values for Status and Resolution on your installation should be documented in the context-sensitive help for those items.

3. Assigned To: The person responsible for fixing the bug.

4. *URL: A URL associated with the bug, if any.

5. Summary: A one-sentence summary of the problem.

6. *Status Whiteboard: (a.k.a. Whiteboard) A free-form text area for adding short notes and tags to a bug.

7. *Keywords: The administrator can define keywords which you can use to tag and categorise bugs - e.g. The Mozilla Project has keywords like crash and regression.

8. Platform and OS: These indicate the computing environment where the bug was found.

9. Version: The "Version" field is usually used for versions of a product which have been released, and is set to indicate which versions of a Component have the particular problem the bug report is about.

10. Priority: The bug assignee uses this field to prioritise his or her bugs. It's a good idea not to change this on other people's bugs.

11. Severity: This indicates how severe the problem is - from blocker ("application unusable") to trivial ("minor cosmetic issue"). You can also use this field to indicate whether a bug is an enhancement request.

12. *Target: (a.k.a. Target Milestone) A future version by which the bug is to be fixed. e.g. The Bugzilla Project's milestones for future Bugzilla versions are 2.18, 2.20, 3.0, etc. Milestones are not restricted to numbers, thought - you can use any text strings, such as dates.

13. Reporter: The person who filed the bug.

14. CC list: A list of people who get mail when the bug changes.

15. Attachments: You can attach files (e.g. testcases or patches) to bugs. If there are any attachments, they are listed in this section.

16. *Dependencies: If this bug cannot be fixed unless other bugs are fixed (depends on), or this bug stops other bugs being fixed (blocks), their numbers are recorded here.

17. *Votes: Whether this bug has any votes.

18. Additional Comments: You can add your two cents to the bug discussion here, if you have something worthwhile to say.

5.4. Searching for Bugs

The Bugzilla Search page is is the interface where you can find any bug report, comment, or patch currently in the Bugzilla system. You can play with it here: http://landfill.bugzilla.org/bugzilla-tip/query.cgi.

The Search page has controls for selecting different possible values for all of the fields in a bug, as described above. For some fields, multiple values can be selected. In those cases, Bugzilla returns bugs where the content of the field matches any one of the selected values. If none is selected, then the field can take any value.

Once you've run a search, you can save it as a Saved Search, which appears in the page footer.

Highly advanced querying is done using Boolean Charts. See the Boolean Charts help link on the Search page for more information.

5.5. Bug Lists

If you run a search, a list of matching bugs will be returned.

The format of the list is configurable. For example, it can be sorted by clicking the column headings. Other useful features can be accessed using the links at the bottom of the list:

5.6. Filing Bugs

Years of bug writing experience has been distilled for your reading pleasure into the Bug Writing Guidelines. While some of the advice is Mozilla-specific, the basic principles of reporting Reproducible, Specific bugs, isolating the Product you are using, the Version of the Product, the Component which failed, the Hardware Platform, and Operating System you were using at the time of the failure go a long way toward ensuring accurate, responsible fixes for the bug that bit you.

The procedure for filing a test bug is as follows:

1. Go to Landfill in your browser and click Enter a new bug report.

2. Select a product - any one will do.

3. Fill in the fields. Bugzilla should have made reasonable guesses, based upon your browser, for the "Platform" and "OS" drop-down boxes. If they are wrong, change them.

4. Select "Commit" and send in your bug report.

Try to make sure that everything said in the summary is also said in the first comment. Summaries are often updated and this will ensure your original information is easily accessible.

You do not need to put "any" or similar strings in the URL field. If there is no specific URL associated with the bug, leave this field blank.

If you feel a bug you filed was incorrectly marked as a DUPLICATE of another, please question it in your bug, not the bug it was duped to. Feel free to CC the person who duped it if they are not already CCed.

5.7. Patch Viewer

Viewing and reviewing patches in Bugzilla is often difficult due to lack of context, improper format and the inherent readability issues that raw patches present. Patch Viewer is an enhancement to Bugzilla designed to fix that by offering increased context, linking to sections, and integrating with Bonsai, LXR and CVS.

Patch viewer allows you to:

5.8. Hints and Tips

This section distills some Bugzilla tips and best practices that have been developed.

5.9. User Preferences

Once you have logged in, you can customise various aspects of Bugzilla via the "Edit prefs" link in the page footer. The preferences are split into three tabs:

---

5.9.2. Email Settings

On this tab you can reduce or increase the amount of email sent you from Bugzilla, opting in our out depending on your relationship to the bug and the change that was made to it.

You can also do further filtering on the client side by using the X-Bugzilla-Reason mail header which Bugzilla adds to all bugmail. This tells you what relationship you have to the bug in question, and can be any of Owner, Reporter, QAcontact, CClist, Voter and WatchingComponent.

By entering user email names, delineated by commas, into the "Users to watch" text entry box you can receive a copy of all the bugmail of other users (security settings permitting.) This powerful functionality enables seamless transitions as developers change projects or users go on holiday.

The ability to watch other users may not be available in all Bugzilla installations. If you can't see it, ask your administrator.

5.10. Reports

To be written