path: root/post_bug.cgi

#!/usr/bin/perl -T
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# This Source Code Form is "Incompatible With Secondary Licenses", as
# defined by the Mozilla Public License, v. 2.0.

use 5.10.1;
use strict;
use warnings;

use lib qw(. lib local/lib/perl5);

use Bugzilla;
use Bugzilla::Attachment;
use Bugzilla::BugMail;
use Bugzilla::Constants;
use Bugzilla::Util;
use Bugzilla::Error;
use Bugzilla::Bug;
use Bugzilla::User;
use Bugzilla::Field;
use Bugzilla::Hook;
use Bugzilla::Product;
use Bugzilla::Component;
use Bugzilla::Keyword;
use Bugzilla::Token;
use Bugzilla::Flag;

use List::MoreUtils qw(uniq);
use MIME::Base64 qw(decode_base64);

my $user = Bugzilla->login(LOGIN_REQUIRED);

my $cgi      = Bugzilla->cgi;
my $dbh      = Bugzilla->dbh;
my $template = Bugzilla->template;
my $vars     = {};

######################################################################
# Main Script
######################################################################

# redirect to enter_bug if no field is passed.
unless ($cgi->param()) {
  print $cgi->redirect(Bugzilla->localconfig->{urlbase} . 'enter_bug.cgi');
  exit;
}

# BMO: Don't allow updating of bugs if disabled
if (Bugzilla->params->{disable_bug_updates}) {
  ThrowErrorPage(
    'bug/process/updates-disabled.html.tmpl',
    'Bug updates are currently disabled.'
  );
}

# Detect if the user already used the same form to submit a bug
my $token = trim($cgi->param('token'));
check_token_data($token, 'create_bug', 'index.cgi');

# do a match on the fields if applicable
# BMO: allow extensions to define custom user fields
my $user_match_fields = {
  'cc'          => {'type' => 'multi'},
  'assigned_to' => {'type' => 'single'},
  'qa_contact'  => {'type' => 'single'},
};
Bugzilla::Hook::process('bug_user_match_fields',
  {fields => $user_match_fields});
Bugzilla::User::match_field($user_match_fields);

if (defined $cgi->param('maketemplate')) {
  $vars->{'url'}        = $cgi->canonicalise_query('token');
  $vars->{'short_desc'} = $cgi->param('short_desc');

  print $cgi->header();
  $template->process("bug/create/make-template.html.tmpl", $vars)
    || ThrowTemplateError($template->error());
  exit;
}

umask 0;

# The format of the initial comment can be structured by adding fields to the
# enter_bug template and then referencing them in the comment template.
my $comment;
my $format
  = $template->get_format("bug/create/comment", scalar($cgi->param('format')),
  "txt");
$template->process($format->{'template'}, $vars, \$comment)
  || ThrowTemplateError($template->error());

# Include custom fields editable on bug creation.
my @custom_bug_fields
  = grep { $_->type != FIELD_TYPE_MULTI_SELECT && $_->enter_bug }
  Bugzilla->active_custom_fields;

# Undefined custom fields are ignored to ensure they will get their default
# value (e.g. "---" for custom single select fields).
my @bug_fields = grep { defined $cgi->param($_->name) } @custom_bug_fields;
@bug_fields = map { $_->name } @bug_fields;

push(
  @bug_fields, qw(
    product
    component

    assigned_to
    qa_contact

    alias
    blocked
    comment_is_private
    bug_file_loc
    bug_severity
    bug_status
    dependson
    keywords
    short_desc
    op_sys
    priority
    rep_platform
    version
    target_milestone
    status_whiteboard
    see_also
    estimated_time
    deadline
    )
);
my %bug_params;
foreach my $field (@bug_fields) {
  $bug_params{$field} = $cgi->param($field);
}
foreach my $field (qw(cc groups)) {
  next if !$cgi->should_set($field);
  $bug_params{$field} = [$cgi->param($field)];
}
$bug_params{'comment'} = $comment;

my @multi_selects
  = grep { $_->type == FIELD_TYPE_MULTI_SELECT && $_->enter_bug }
  Bugzilla->active_custom_fields;

foreach my $field (@multi_selects) {
  next if !$cgi->should_set($field->name);
  $bug_params{$field->name} = [$cgi->param($field->name)];
}

# BMO - add user_match_fields.  it's important to source from input_params
# instead of $cgi->param to ensure we get the correct value.
foreach my $field (keys %$user_match_fields) {
  next if exists $bug_params{$field};
  next unless $cgi->should_set($field);
  $bug_params{$field} = Bugzilla->input_params->{$field} // [];
}

my $bug = Bugzilla::Bug->create(\%bug_params);

# Get the bug ID back and delete the token used to create this bug.
my $id = $bug->bug_id;
delete_token($token);

# We do this directly from the DB because $bug->creation_ts has the seconds
# formatted out of it (which should be fixed some day).
my $timestamp
  = $dbh->selectrow_array('SELECT creation_ts FROM bugs WHERE bug_id = ?',
  undef, $id);

# Set Version cookie, but only if the user actually selected
# a version on the page.
if (defined $cgi->param('version')) {
  $cgi->send_cookie(
    -name    => "VERSION-" . $bug->product,
    -value   => $bug->version,
    -expires => "Fri, 01-Jan-2038 00:00:00 GMT"
  );
}

# We don't have to check if the user can see the bug, because a user filing
# a bug can always see it. You can't change reporter_accessible until
# after the bug is filed.

# Add an attachment if requested.
my $data_fh     = $cgi->upload('data');
my $attach_text = $cgi->param('attach_text');
my $data_base64 = $cgi->param('data_base64');

if ($data_fh || $attach_text || $data_base64) {
  $cgi->param('isprivate', $cgi->param('comment_is_private'));

  # Must be called before create() as it may alter $cgi->param('ispatch').
  my $content_type = Bugzilla::Attachment::get_content_type();
  my $attachment;
  my $data;
  my $filename;

  if ($attach_text) {

    # Convert to unix line-endings if pasting a patch
    if (scalar($cgi->param('ispatch'))) {
      $attach_text =~ s/[\012\015]{1,2}/\012/g;
    }
    $data     = $attach_text;
    $filename = "file_$id.txt";
  }
  elsif ($data_base64) {
    $data = decode_base64($data_base64);
    $filename = $cgi->param('filename') || "file_$id";
  }
  else {
    $data = $filename = $data_fh;
  }

  # If the attachment cannot be successfully added to the bug,
  # we notify the user, but we don't interrupt the bug creation process.
  my $error_mode_cache = Bugzilla->error_mode;
  Bugzilla->error_mode(ERROR_MODE_DIE);
  eval {
    $attachment = Bugzilla::Attachment->create({
      bug         => $bug,
      creation_ts => $timestamp,
      data        => $data,
      description => scalar $cgi->param('description'),
      filename    => $filename,
      ispatch     => scalar $cgi->param('ispatch'),
      isprivate   => scalar $cgi->param('isprivate'),
      mimetype    => $content_type,
    });
  };
  Bugzilla->error_mode($error_mode_cache);

  if ($attachment) {

    # Set attachment flags.
    Bugzilla::Hook::process('post_bug_attachment_flags',
      {bug => $bug, attachment => $attachment});
    my ($flags, $new_flags)
      = Bugzilla::Flag->extract_flags_from_cgi($bug, $attachment, $vars,
      SKIP_REQUESTEE_ON_ERROR);
    $attachment->set_flags($flags, $new_flags);
    $attachment->update($timestamp);
    my $comment = $bug->comments->[0];
    $comment->set_all(
      {type => CMT_ATTACHMENT_CREATED, extra_data => $attachment->id});
    $comment->update();
  }
  else {
    $vars->{'message'} = 'attachment_creation_failed';
  }
}

# Set bug_ignored from the hidden field
if (scalar $cgi->param('bug_ignored')) {
  $bug->set_bug_ignored(1);
}

# Set bug flags.
my ($flags, $new_flags)
  = Bugzilla::Flag->extract_flags_from_cgi($bug, undef, $vars,
  SKIP_REQUESTEE_ON_ERROR);
$bug->set_flags($flags, $new_flags);
$bug->update($timestamp);

$vars->{'id'}  = $id;
$vars->{'bug'} = $bug;

Bugzilla::Hook::process('post_bug_after_creation', {vars => $vars});

ThrowCodeError("bug_error", {bug => $bug}) if $bug->error;

my $recipients = {changer => $user};
my $bug_sent = Bugzilla::BugMail::Send($id, $recipients);
$bug_sent->{type} = 'created';
$bug_sent->{id}   = $id;
my @all_mail_results = ($bug_sent);

foreach my $dep (@{$bug->dependson || []}, @{$bug->blocked || []}) {
  my $dep_sent = Bugzilla::BugMail::Send($dep, $recipients);
  $dep_sent->{type} = 'dep';
  $dep_sent->{id}   = $dep;
  push(@all_mail_results, $dep_sent);
}

# Sending emails for any referenced bugs.
foreach my $ref_bug_id (uniq @{$bug->{see_also_changes} || []}) {
  my $ref_sent = Bugzilla::BugMail::Send($ref_bug_id, $recipients);
  $ref_sent->{id} = $ref_bug_id;
  push(@all_mail_results, $ref_sent);
}

$vars->{sentmail} = \@all_mail_results;

$format = $template->get_format("bug/create/created",
  scalar($cgi->param('created-format')), "html");

# don't leak the enter_bug format param to show_bug
$cgi->delete('format');

if ($user->setting('ui_experiments') eq 'on') {
  Bugzilla->cgi->content_security_policy(
    Bugzilla::CGI::SHOW_BUG_MODAL_CSP($bug->id));
}
print $cgi->header();
$template->process($format->{'template'}, $vars)
  || ThrowTemplateError($template->error());

1;