# Contributor(s): Terry Weissman <terry@mozilla.org>
# Dan Mosedale <dmose@mozilla.org>
# Jake <jake@acutex.net>
-# Bradley Baetz <bbaetz@cs.mcgill.ca>
# Contains some global variables and routines used throughout bugzilla.
$zz = @main::milestoneurl;
$zz = @main::prodmaxvotes;
$zz = $main::superusergroupset;
- $zz = $main::userid;
}
#
#use Carp; # for confess
use RelationSet;
-# Some environment variables are not taint safe
-delete $ENV{qw(PATH IFS CDPATH ENV BASH_ENV)};
+# $ENV{PATH} is not taint safe
+delete $ENV{PATH};
# Contains the version string for the current running Bugzilla.
-$::param{'version'} = '2.15';
+$::param{'version'} = '2.14.1';
$::dontchange = "--do_not_change--";
$::chooseone = "--Choose_one:--";
$name = Param("shadowdb");
$::dbwritesallowed = 0;
}
- $::db = DBI->connect("DBI:mysql:host=$::db_host;database=$name", $::db_user, $::db_pass)
- || die "Bugzilla is currently broken. Please try again later. " .
+ $::db = DBI->connect("DBI:mysql:host=$::db_host;database=$name", $::db_user, $::db_pass)
+ || die "Bugzilla is currently broken. Please try again later. " .
"If the problem persists, please contact " . Param("maintainer") .
". The error you should quote is: " . $DBI::errstr;
}
}
SqlLog($str);
$::currentquery = $::db->prepare($str);
- if (!$::currentquery->execute) {
- my $errstr = $::db->errstr;
- # Cut down the error string to a reasonable.size
- $errstr = substr($errstr, 0, 2000) . ' ... ' . substr($errstr, -2000)
- if length($errstr) > 4000;
- die "$str: " . $errstr;
- }
+ $::currentquery->execute
+ || die "$str: " . $::db->errstr;
SqlLog("Done");
if (!$dontshadow && $iswrite && Param("shadowdb")) {
my $q = SqlQuote($str);
return 0;
}
if (defined @::fetchahead) {
- return 1;
+ return 1;
}
if (@::fetchahead = $::currentquery->fetchrow_array) {
- return 1;
+ return 1;
}
return 0;
}
return;
}
if (defined @::fetchahead) {
- my @result = @::fetchahead;
- undef @::fetchahead;
- return @result;
+ my @result = @::fetchahead;
+ undef @::fetchahead;
+ return @result;
}
return $::currentquery->fetchrow_array;
}
$result = "";
foreach my $k (sort { uc($a) cmp uc($b)} eval("keys $name")) {
$result .= GenerateCode("\$" . substr($name, 1) .
- "{" . PerlQuote($k) . "}");
+ "{'" . $k . "'}");
}
return $result;
} else {
my $tmpname = "data/versioncache.$$";
open(FID, ">$tmpname") || die "Can't create $tmpname";
- print FID "#\n";
- print FID "# DO NOT EDIT!\n";
- print FID "# This file is automatically generated at least once every\n";
- print FID "# hour by the GenerateVersionTable() sub in globals.pl.\n";
- print FID "# Any changes you make will be overwritten.\n";
- print FID "#\n";
-
print FID GenerateCode('@::log_columns');
print FID GenerateCode('%::versions');
return $password;
}
-sub SelectVisible {
- my ($query, $userid, $usergroupset) = @_;
-
- # Run the SQL $query with the additional restriction that
- # the bugs can be seen by $userid. $usergroupset is provided
- # as an optimisation when this is already known, eg from CGI.pl
- # If not present, it will be obtained from the db.
- # Assumes that 'bugs' is mentioned as a table name. You should
- # also make sure that bug_id is qualified bugs.bug_id!
- # Your query must have a WHERE clause. This is unlikely to be a problem.
-
- # Also, note that mySQL requires aliases for tables to be locked, as well
- # This means that if you change the name from selectVisible_cc (or add
- # additional tables), you will need to update anywhere which does a
- # LOCK TABLE, and then calls routines which call this
-
- $usergroupset = 0 unless $userid;
-
- unless (defined($usergroupset)) {
- PushGlobalSQLState();
- SendSQL("SELECT groupset FROM profiles WHERE userid = $userid");
- $usergroupset = FetchOneColumn();
- PopGlobalSQLState();
- }
-
- # Users are authorized to access bugs if they are a member of all
- # groups to which the bug is restricted. User group membership and
- # bug restrictions are stored as bits within bitsets, so authorization
- # can be determined by comparing the intersection of the user's
- # bitset with the bug's bitset. If the result matches the bug's bitset
- # the user is a member of all groups to which the bug is restricted
- # and is authorized to access the bug.
-
- # A user is also authorized to access a bug if she is the reporter,
- # assignee, QA contact, or member of the cc: list of the bug and the bug
- # allows users in those roles to see the bug. The boolean fields
- # reporter_accessible, assignee_accessible, qacontact_accessible, and
- # cclist_accessible identify whether or not those roles can see the bug.
-
- # Bit arithmetic is performed by MySQL instead of Perl because bitset
- # fields in the database are 64 bits wide (BIGINT), and Perl installations
- # may or may not support integers larger than 32 bits. Using bitsets
- # and doing bitset arithmetic is probably not cross-database compatible,
- # however, so these mechanisms are likely to change in the future.
-
- my $replace = " ";
-
- if ($userid) {
- $replace .= "LEFT JOIN cc selectVisible_cc ON
- bugs.bug_id = selectVisible_cc.bug_id AND
- selectVisible_cc.who = $userid "
- }
-
- $replace .= "WHERE ((bugs.groupset & $usergroupset) = bugs.groupset ";
-
- if ($userid) {
- # There is a mysql bug affecting v3.22 and 3.23 (at least), where this will
- # cause all rows to be returned! We work arround this by adding an not isnull
- # test to the JOINed cc table. See http://lists.mysql.com/cgi-ez/ezmlm-cgi?9:mss:11417
- # Its needed, even though it shouldn't be
- $replace .= "OR (bugs.reporter_accessible = 1 AND bugs.reporter = $userid)
- OR (bugs.assignee_accessible = 1 AND bugs.assigned_to = $userid)
- OR (bugs.qacontact_accessible = 1 AND bugs.qa_contact = $userid)
- OR (bugs.cclist_accessible = 1 AND selectVisible_cc.who = $userid AND not isnull(selectVisible_cc.who))";
- }
-
- $replace .= ") AND ";
-
- $query =~ s/\sWHERE\s/$replace/i;
-
- return $query;
-}
-
-sub CanSeeBug {
- # Note that we pass in the usergroupset, since this is known
- # in most cases (ie viewing bugs). Maybe make this an optional
- # parameter?
-
- my ($id, $userid, $usergroupset) = @_;
-
- # Query the database for the bug, retrieving a boolean value that
- # represents whether or not the user is authorized to access the bug.
-
- PushGlobalSQLState();
- SendSQL(SelectVisible("SELECT bugs.bug_id FROM bugs WHERE bugs.bug_id = $id",
- $userid, $usergroupset));
-
- my $ret = defined(FetchSQLData());
- PopGlobalSQLState();
-
- return $ret;
-}
sub ValidatePassword {
# Determines whether or not a password is valid (i.e. meets Bugzilla's
exit(0);
}
-# Use trick_taint() when you know that there is no way that the data
+# Use detaint_string() when you know that there is no way that the data
# in a scalar can be tainted, but taint mode still bails on it.
# WARNING!! Using this routine on data that really could be tainted
# defeats the purpose of taint mode. It should only be
# used on variables that cannot be touched by users.
-sub trick_taint {
- $_[0] =~ /^(.*)$/s;
- $_[0] = $1;
- return (defined($_[0]));
-}
-
-sub detaint_natural {
- $_[0] =~ /^(\d+)$/;
- $_[0] = $1;
- return (defined($_[0]));
+sub detaint_string {
+ my ($str) = @_;
+ $str =~ m/^(.*)$/s;
+ $str = $1;
}
# This routine quoteUrls contains inspirations from the HTML::FromText CPAN
$things[$count++] = $item;
}
- # Either a comment string or no comma and a compulsory #.
- while ($text =~ s/\bbug(\s|%\#)*(\d+),?\s*comment\s*(\s|%\#)(\d+)/"##$count##"/ei) {
- my $item = $&;
- my $bugnum = $2;
- my $comnum = $4;
- $item = GetBugLink($bugnum, $item);
- $item =~ s/(id=\d+)/$1#c$comnum/;
- $things[$count++] = $item;
- }
- while ($text =~ s/\bcomment(\s|%\#)*(\d+)/"##$count##"/ei) {
- my $item = $&;
- my $num = $2;
- $item = value_quote($item);
- $item = qq{<A HREF="#c$num">$item</A>};
- $things[$count++] = $item;
- }
while ($text =~ s/\bbug(\s|%\#)*(\d+)/"##$count##"/ei) {
my $item = $&;
my $num = $2;
}
$text = value_quote($text);
- $text =~ s/\
/\n/g;
+ $text =~ s/\
/\n/g;
# Stuff everything back from the array.
for (my $i=0 ; $i<$count ; $i++) {
sub GetBugLink {
my ($bug_num, $link_text) = (@_);
- detaint_natural($bug_num) || die "GetBugLink() called with non-integer bug number";
-
- # If we've run GetBugLink() for this bug number before, %::buglink
- # will contain an anonymous array ref of relevent values, if not
- # we need to get the information from the database.
- if (! defined $::buglink{$bug_num}) {
- # Make sure any unfetched data from a currently running query
- # is saved off rather than overwritten
- PushGlobalSQLState();
+ my ($link_return) = "";
- SendSQL("SELECT bugs.bug_status, resolution, short_desc, groupset " .
- "FROM bugs WHERE bugs.bug_id = $bug_num");
-
- # If the bug exists, save its data off for use later in the sub
- if (MoreSQLData()) {
- my ($bug_state, $bug_res, $bug_desc, $bug_grp) = FetchSQLData();
- # Initialize these variables to be "" so that we don't get warnings
- # if we don't change them below (which is highly likely).
- my ($pre, $title, $post) = ("", "", "");
+ # TODO - Add caching capabilites... possibly use a global variable in the form
+ # of $buglink{$bug_num} that contains the text returned by this sub. If that
+ # variable is defined, simply return it's value rather than running the SQL
+ # query. This would cut down on the number of SQL calls when the same bug is
+ # referenced multiple times.
+
+ # Make sure any unfetched data from a currently running query
+ # is saved off rather than overwritten
+ PushGlobalSQLState();
+
+ # Get this bug's info from the SQL Database
+ SendSQL("select bugs.bug_status, resolution, short_desc, groupset
+ from bugs where bugs.bug_id = $bug_num");
+ my ($bug_stat, $bug_res, $bug_desc, $bug_grp) = (FetchSQLData());
+
+ # Format the retrieved information into a link
+ if ($bug_stat eq "UNCONFIRMED") { $link_return .= "<i>" }
+ if ($bug_res ne "") { $link_return .= "<strike>" }
+ $bug_desc = value_quote($bug_desc);
+ $link_text = value_quote($link_text);
+ $link_return .= qq{<a href="show_bug.cgi?id=$bug_num" title="$bug_stat};
+ if ($bug_res ne "") {$link_return .= " $bug_res"}
+ if ($bug_grp == 0) { $link_return .= " - $bug_desc" }
+ $link_return .= qq{">$link_text</a>};
+ if ($bug_res ne "") { $link_return .= "</strike>" }
+ if ($bug_stat eq "UNCONFIRMED") { $link_return .= "</i>"}
+
+ # Put back any query in progress
+ PopGlobalSQLState();
- $title = $bug_state;
- if ($bug_state eq $::unconfirmedstate) {
- $pre = "<i>";
- $post = "</i>";
- }
- elsif (! IsOpenedState($bug_state)) {
- $pre = "<strike>";
- $title .= " $bug_res";
- $post = "</strike>";
- }
- if ($bug_grp == 0 || CanSeeBug($bug_num, $::userid, $::usergroupset)) {
- $title .= " - $bug_desc";
- }
- $::buglink{$bug_num} = [$pre, value_quote($title), $post];
- }
- else {
- # Even if there's nothing in the database, we want to save a blank
- # anonymous array in the %::buglink hash so the query doesn't get
- # run again next time we're called for this bug number.
- $::buglink{$bug_num} = [];
- }
- # All done with this sidetrip
- PopGlobalSQLState();
- }
+ return $link_return;
- # Now that we know we've got all the information we're gonna get, let's
- # return the link (which is the whole reason we were called :)
- my ($pre, $title, $post) = @{$::buglink{$bug_num}};
- # $title will be undefined if the bug didn't exist in the database.
- if (defined $title) {
- return qq{$pre<a href="show_bug.cgi?id=$bug_num" title="$title">$link_text</a>$post};
- }
- else {
- return qq{$link_text};
- }
}
sub GetLongDescriptionAsText {
my ($who, $email, $when, $text) = (FetchSQLData());
$email .= Param('emailsuffix');
if ($count) {
- $result .= qq|<BR><BR><I>------- Additional Comment <a name="c$count" href="#c$count">#$count</a> From |;
- if ($who) {
- $result .= qq{<A HREF="mailto:$email">$who</A> };
- } else {
- $result .= qq{<A HREF="mailto:$email">$email</A> };
- }
-
- $result .= time2str("%Y-%m-%d %H:%M", str2time($when)) . " -------</I><BR>\n";
+ $result .= "<BR><BR><I>------- Additional Comments From ";
+ if ($who) {
+ $result .= qq{<A HREF="mailto:$email">$who</A> } .
+ time2str("%Y-%m-%d %H:%M", str2time($when)) .
+ " -------</I><BR>\n";
+ } else {
+ $result .= qq{<A HREF="mailto:$email">$email</A> } .
+ time2str("%Y-%m-%d %H:%M", str2time($when)) .
+ " -------</I><BR>\n";
+ }
}
$result .= "<PRE>" . quoteUrls(\%knownattachments, $text) . "</PRE>\n";
$count++;
while ($guts =~ /^\'([^\']*)\',(.*)$/) {
push @result, $1;
$guts = $2;
- }
+ }
}
return @result;
}
$str =~ s/([\\\'])/\\$1/g;
$str =~ s/\0/\\0/g;
# If it's been SqlQuote()ed, then it's safe, so we tell -T that.
- trick_taint($str);
+ $str = detaint_string($str);
return "'$str'";
}
sub IsOpenedState {
my ($state) = (@_);
- if (grep($_ eq $state, OpenStates())) {
+ if ($state =~ /^(NEW|REOPENED|ASSIGNED)$/ || $state eq $::unconfirmedstate) {
return 1;
}
return 0;
}
-# This sub will return an array containing any status that
-# is considered an open bug.
-
-sub OpenStates {
- return ('NEW', 'REOPENED', 'ASSIGNED', $::unconfirmedstate);
-}
-
sub RemoveVotes {
my ($id, $who, $reason) = (@_);
projects / thirdparty / bugzilla.git / commitdiff
