Skip to content

Commit b6e79d0

Browse files
ddkilzerddkilzer
committed
Upgrade to Bugzilla 4.2.7.
Conflicts: buglist.cgi report.cgi Canonical link: https://commits.webkit.org/155624@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@174765 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent f4a270a commit b6e79d0

102 files changed

Lines changed: 1818 additions & 727 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Websites/bugs.webkit.org/.htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Don't allow people to retrieve non-cgi executable files or our private data
2-
<FilesMatch ^(.*\.pm|.*\.pl|.*localconfig.*)$>
2+
<FilesMatch (\.pm|\.pl|\.tmpl|localconfig.*)$>
33
deny from all
44
</FilesMatch>
55
<FilesMatch ^(localconfig.js|localconfig.rdf)$>

‎Websites/bugs.webkit.org/Bugzilla.pm‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -592,7 +592,8 @@ sub fields {
592592
}
593593
}
594594

595-
return $do_by_name ? \%requested : [values %requested];
595+
return $do_by_name ? \%requested
596+
: [sort { $a->sortkey <=> $b->sortkey || $a->name cmp $b->name } values %requested];
596597
}
597598

598599
sub active_custom_fields {
@@ -847,7 +848,7 @@ in a hashref:
847848
=item C<by_name>
848849
849850
If false (or not specified), this method will return an arrayref of
850-
the requested fields. The order of the returned fields is random.
851+
the requested fields.
851852
852853
If true, this method will return a hashref of fields, where the keys
853854
are field names and the valules are L<Bugzilla::Field> objects.

‎Websites/bugs.webkit.org/Bugzilla/Attachment.pm‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -723,11 +723,8 @@ sub validate_obsolete {
723723
$attachment->validate_can_edit($bug->product_id)
724724
|| ThrowUserError('illegal_attachment_edit', { attach_id => $attachment->id });
725725

726-
$vars->{'description'} = $attachment->description;
727-
728726
if ($attachment->bug_id != $bug->bug_id) {
729727
$vars->{'my_bug_id'} = $bug->bug_id;
730-
$vars->{'attach_bug_id'} = $attachment->bug_id;
731728
ThrowCodeError('mismatched_bug_ids_on_obsolete', $vars);
732729
}
733730

‎Websites/bugs.webkit.org/Bugzilla/Attachment/PatchReader.pm‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ sub process_diff {
3737
$last_reader->sends_data_to(new PatchReader::DiffPrinter::raw());
3838
# Actually print out the patch.
3939
print $cgi->header(-type => 'text/plain',
40-
-x_content_type_options => "nosniff",
4140
-expires => '+3M');
4241
disable_utf8();
4342
$reader->iterate_string('Attachment ' . $attachment->id, $attachment->data);
@@ -119,7 +118,6 @@ sub process_interdiff {
119118
$last_reader->sends_data_to(new PatchReader::DiffPrinter::raw());
120119
# Actually print out the patch.
121120
print $cgi->header(-type => 'text/plain',
122-
-x_content_type_options => "nosniff",
123121
-expires => '+3M');
124122
disable_utf8();
125123
}

‎Websites/bugs.webkit.org/Bugzilla/Auth/Login/Cookie.pm‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,16 +60,16 @@ sub get_login_info {
6060
trick_taint($login_cookie);
6161
detaint_natural($user_id);
6262

63-
my $is_valid =
64-
$dbh->selectrow_array('SELECT 1
63+
my $db_cookie =
64+
$dbh->selectrow_array('SELECT cookie
6565
FROM logincookies
6666
WHERE cookie = ?
6767
AND userid = ?
6868
AND (ipaddr = ? OR ipaddr IS NULL)',
6969
undef, ($login_cookie, $user_id, $ip_addr));
7070

7171
# If the cookie is valid, return a valid username.
72-
if ($is_valid) {
72+
if (defined $db_cookie && $login_cookie eq $db_cookie) {
7373
# If we logged in successfully, then update the lastused
7474
# time on the login cookie
7575
$dbh->do("UPDATE logincookies SET lastused = NOW()

‎Websites/bugs.webkit.org/Bugzilla/Auth/Verify/LDAP.pm‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ use Bugzilla::User;
4141
use Bugzilla::Util;
4242

4343
use Net::LDAP;
44+
use Net::LDAP::Util qw(escape_filter_value);
4445

4546
use constant admin_can_create_account => 0;
4647
use constant user_can_create_account => 0;
@@ -144,6 +145,7 @@ sub check_credentials {
144145

145146
sub _bz_search_params {
146147
my ($username) = @_;
148+
$username = escape_filter_value($username);
147149
return (base => Bugzilla->params->{"LDAPBaseDN"},
148150
scope => "sub",
149151
filter => '(&(' . Bugzilla->params->{"LDAPuidattribute"}

‎Websites/bugs.webkit.org/Bugzilla/Bug.pm‎

Lines changed: 52 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -523,17 +523,14 @@ sub possible_duplicates {
523523
if ($dbh->FULLTEXT_OR) {
524524
my $joined_terms = join($dbh->FULLTEXT_OR, @words);
525525
($where_sql, $relevance_sql) =
526-
$dbh->sql_fulltext_search('bugs_fulltext.short_desc',
527-
$joined_terms, 1);
526+
$dbh->sql_fulltext_search('bugs_fulltext.short_desc', $joined_terms);
528527
$relevance_sql ||= $where_sql;
529528
}
530529
else {
531530
my (@where, @relevance);
532-
my $count = 0;
533531
foreach my $word (@words) {
534-
$count++;
535532
my ($term, $rel_term) = $dbh->sql_fulltext_search(
536-
'bugs_fulltext.short_desc', $word, $count);
533+
'bugs_fulltext.short_desc', $word);
537534
push(@where, $term);
538535
push(@relevance, $rel_term || $term);
539536
}
@@ -733,6 +730,17 @@ sub run_create_validators {
733730
my $class = shift;
734731
my $params = $class->SUPER::run_create_validators(@_);
735732

733+
# Add classification for checking mandatory fields which depend on it
734+
$params->{classification} = $params->{product}->classification->name;
735+
736+
my @mandatory_fields = @{ Bugzilla->fields({ is_mandatory => 1,
737+
enter_bug => 1,
738+
obsolete => 0 }) };
739+
foreach my $field (@mandatory_fields) {
740+
$class->_check_field_is_mandatory($params->{$field->name}, $field,
741+
$params);
742+
}
743+
736744
my $product = delete $params->{product};
737745
$params->{product_id} = $product->id;
738746
my $component = delete $params->{component};
@@ -757,18 +765,11 @@ sub run_create_validators {
757765
delete $params->{resolution};
758766
delete $params->{lastdiffed};
759767
delete $params->{bug_id};
768+
delete $params->{classification};
760769

761770
Bugzilla::Hook::process('bug_end_of_create_validators',
762771
{ params => $params });
763772

764-
my @mandatory_fields = @{ Bugzilla->fields({ is_mandatory => 1,
765-
enter_bug => 1,
766-
obsolete => 0 }) };
767-
foreach my $field (@mandatory_fields) {
768-
$class->_check_field_is_mandatory($params->{$field->name}, $field,
769-
$params);
770-
}
771-
772773
return $params;
773774
}
774775

@@ -1371,7 +1372,7 @@ sub _check_bug_status {
13711372
}
13721373

13731374
# Check if a comment is required for this change.
1374-
if ($new_status->comment_required_on_change_from($old_status) && !$comment)
1375+
if ($new_status->comment_required_on_change_from($old_status) && !$comment->{'thetext'})
13751376
{
13761377
ThrowUserError('comment_required', { old => $old_status,
13771378
new => $new_status });
@@ -1465,8 +1466,12 @@ sub _check_component {
14651466
$name || ThrowUserError("require_component");
14661467
my $product = blessed($invocant) ? $invocant->product_obj
14671468
: $params->{product};
1468-
my $obj = Bugzilla::Component->check({ product => $product, name => $name });
1469-
return $obj;
1469+
my $old_comp = blessed($invocant) ? $invocant->component : '';
1470+
my $object = Bugzilla::Component->check({ product => $product, name => $name });
1471+
if ($object->name ne $old_comp && !$object->is_active) {
1472+
ThrowUserError('value_inactive', { class => ref($object), value => $name });
1473+
}
1474+
return $object;
14701475
}
14711476

14721477
sub _check_creation_ts {
@@ -1908,10 +1913,14 @@ sub _check_target_milestone {
19081913
my ($invocant, $target, undef, $params) = @_;
19091914
my $product = blessed($invocant) ? $invocant->product_obj
19101915
: $params->{product};
1916+
my $old_target = blessed($invocant) ? $invocant->target_milestone : '';
19111917
$target = trim($target);
19121918
$target = $product->default_milestone if !defined $target;
19131919
my $object = Bugzilla::Milestone->check(
19141920
{ product => $product, name => $target });
1921+
if ($old_target && $object->name ne $old_target && !$object->is_active) {
1922+
ThrowUserError('value_inactive', { class => ref($object), value => $target });
1923+
}
19151924
return $object->name;
19161925
}
19171926

@@ -1934,8 +1943,11 @@ sub _check_version {
19341943
$version = trim($version);
19351944
my $product = blessed($invocant) ? $invocant->product_obj
19361945
: $params->{product};
1937-
my $object =
1938-
Bugzilla::Version->check({ product => $product, name => $version });
1946+
my $old_vers = blessed($invocant) ? $invocant->version : '';
1947+
my $object = Bugzilla::Version->check({ product => $product, name => $version });
1948+
if ($object->name ne $old_vers && !$object->is_active) {
1949+
ThrowUserError('value_inactive', { class => ref($object), value => $version });
1950+
}
19391951
return $object->name;
19401952
}
19411953

@@ -1953,6 +1965,12 @@ sub _check_field_is_mandatory {
19531965

19541966
return if !$field->is_visible_on_bug($params || $invocant);
19551967

1968+
return if ($field->type == FIELD_TYPE_SINGLE_SELECT
1969+
&& scalar @{ get_legal_field_values($field->name) } == 1);
1970+
1971+
return if ($field->type == FIELD_TYPE_MULTI_SELECT
1972+
&& !scalar @{ get_legal_field_values($field->name) });
1973+
19561974
if (ref($value) eq 'ARRAY') {
19571975
$value = join('', @$value);
19581976
}
@@ -2464,9 +2482,9 @@ sub _set_product {
24642482
milestone => $milestone_ok ? $self->target_milestone
24652483
: $product->default_milestone
24662484
};
2467-
$vars{components} = [map { $_->name } @{$product->components}];
2468-
$vars{milestones} = [map { $_->name } @{$product->milestones}];
2469-
$vars{versions} = [map { $_->name } @{$product->versions}];
2485+
$vars{components} = [map { $_->name } grep($_->is_active, @{$product->components})];
2486+
$vars{milestones} = [map { $_->name } grep($_->is_active, @{$product->milestones})];
2487+
$vars{versions} = [map { $_->name } grep($_->is_active, @{$product->versions})];
24702488
}
24712489

24722490
if (!$verified) {
@@ -2872,7 +2890,8 @@ sub add_see_also {
28722890
# ref bug id for sending changes email.
28732891
my $ref_bug = delete $field_values->{ref_bug};
28742892
if ($class->isa('Bugzilla::BugUrl::Bugzilla::Local')
2875-
and !$skip_recursion)
2893+
and !$skip_recursion
2894+
and $ref_bug->check_can_change_field('see_also', '', $self->id, \$privs))
28762895
{
28772896
$ref_bug->add_see_also($self->id, 'skip_recursion');
28782897
push @{ $self->{_update_ref_bugs} }, $ref_bug;
@@ -2904,12 +2923,15 @@ sub remove_see_also {
29042923
# we need to notify changes for that bug too.
29052924
$removed_bug_url = $removed_bug_url->[0];
29062925
if (!$skip_recursion and $removed_bug_url
2907-
and $removed_bug_url->isa('Bugzilla::BugUrl::Bugzilla::Local'))
2926+
and $removed_bug_url->isa('Bugzilla::BugUrl::Bugzilla::Local')
2927+
and $removed_bug_url->ref_bug_url)
29082928
{
29092929
my $ref_bug
29102930
= Bugzilla::Bug->check($removed_bug_url->ref_bug_url->bug_id);
29112931

2912-
if (Bugzilla->user->can_edit_product($ref_bug->product_id)) {
2932+
if (Bugzilla->user->can_edit_product($ref_bug->product_id)
2933+
and $ref_bug->check_can_change_field('see_also', $self->id, '', \$privs))
2934+
{
29132935
my $self_url = $removed_bug_url->local_uri($self->id);
29142936
$ref_bug->remove_see_also($self_url, 'skip_recursion');
29152937
push @{ $self->{_update_ref_bugs} }, $ref_bug;
@@ -3632,17 +3654,21 @@ sub bug_alias_to_id {
36323654
# Subroutines
36333655
#####################################################################
36343656

3635-
# Represents which fields from the bugs table are handled by process_bug.cgi.
3657+
# Returns a list of currently active and editable bug fields,
3658+
# including multi-select fields.
36363659
sub editable_bug_fields {
36373660
my @fields = Bugzilla->dbh->bz_table_columns('bugs');
3661+
# Add multi-select fields
3662+
push(@fields, map { $_->name } @{Bugzilla->fields({obsolete => 0,
3663+
type => FIELD_TYPE_MULTI_SELECT})});
36383664
# Obsolete custom fields are not editable.
36393665
my @obsolete_fields = @{ Bugzilla->fields({obsolete => 1, custom => 1}) };
36403666
@obsolete_fields = map { $_->name } @obsolete_fields;
36413667
foreach my $remove ("bug_id", "reporter", "creation_ts", "delta_ts",
36423668
"lastdiffed", @obsolete_fields)
36433669
{
36443670
my $location = firstidx { $_ eq $remove } @fields;
3645-
# Custom multi-select fields are not stored in the bugs table.
3671+
# Ensure field exists before attempting to remove it.
36463672
splice(@fields, $location, 1) if ($location > -1);
36473673
}
36483674
# Sorted because the old @::log_columns variable, which this replaces,

‎Websites/bugs.webkit.org/Bugzilla/CGI.pm‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,16 @@ sub clean_search_url {
169169
# Delete leftovers from the login form
170170
$self->delete('Bugzilla_remember', 'GoAheadAndLogIn');
171171

172+
# Delete the token if we're not performing an action which needs it
173+
unless ((defined $self->param('remtype')
174+
&& ($self->param('remtype') eq 'asdefault'
175+
|| $self->param('remtype') eq 'asnamed'))
176+
|| (defined $self->param('remaction')
177+
&& $self->param('remaction') eq 'forget'))
178+
{
179+
$self->delete("token");
180+
}
181+
172182
foreach my $num (1,2,3) {
173183
# If there's no value in the email field, delete the related fields.
174184
if (!$self->param("email$num")) {
@@ -306,6 +316,14 @@ sub header {
306316
unshift(@_, '-x_frame_options' => 'SAMEORIGIN');
307317
}
308318

319+
# Add X-XSS-Protection header to prevent simple XSS attacks
320+
# and enforce the blocking (rather than the rewriting) mode.
321+
unshift(@_, '-x_xss_protection' => '1; mode=block');
322+
323+
# Add X-Content-Type-Options header to prevent browsers sniffing
324+
# the MIME type away from the declared Content-Type.
325+
unshift(@_, '-x_content_type_options' => 'nosniff');
326+
309327
return $self->SUPER::header(@_) || "";
310328
}
311329

@@ -353,7 +371,7 @@ sub param {
353371
sub _fix_utf8 {
354372
my $input = shift;
355373
# The is_utf8 is here in case CGI gets smart about utf8 someday.
356-
utf8::decode($input) if defined $input && !utf8::is_utf8($input);
374+
utf8::decode($input) if defined $input && !ref $input && !utf8::is_utf8($input);
357375
return $input;
358376
}
359377

‎Websites/bugs.webkit.org/Bugzilla/Config/MTA.pm‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,12 @@ package Bugzilla::Config::MTA;
3434
use strict;
3535

3636
use Bugzilla::Config::Common;
37+
# Return::Value 1.666002 pollutes the error log with warnings about this
38+
# deprecated module. We have to set NO_CLUCK = 1 before loading Email::Send
39+
# to disable these warnings.
40+
BEGIN {
41+
$Return::Value::NO_CLUCK = 1;
42+
}
3743
use Email::Send;
3844

3945
our $sortkey = 1200;

‎Websites/bugs.webkit.org/Bugzilla/Constants.pm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ use Memoize;
203203
# CONSTANTS
204204
#
205205
# Bugzilla version
206-
use constant BUGZILLA_VERSION => "4.2.1";
206+
use constant BUGZILLA_VERSION => "4.2.7";
207207

208208
# Location of the remote and local XML files to track new releases.
209209
use constant REMOTE_FILE => 'http://updates.bugzilla.org/bugzilla-update.xml';

0 commit comments

Comments
 (0)