diff --git a/mozilla/webtools/bugzilla/CGI.pl b/mozilla/webtools/bugzilla/CGI.pl index 6d06cec7915..4687a0d83c9 100644 --- a/mozilla/webtools/bugzilla/CGI.pl +++ b/mozilla/webtools/bugzilla/CGI.pl @@ -865,6 +865,21 @@ sub confirm_login { exit; } + # if no password was provided, then fail the authentication + # while it may be valid to not have an LDAP password, when you + # bind without a password (regardless of the binddn value), you + # will get an anonymous bind. I do not know of a way to determine + # whether a bind is anonymous or not without making changes to the + # LDAP access control settings + if ( ! $::FORM{"LDAP_password"} ) { + print "Content-type: text/html\n\n"; + PutHeader("Login Failed"); + print "You did not provide a password.\n"; + print "Please click Back and try again.\n"; + PutFooter(); + exit; + } + # We've got our anonymous bind; let's look up this user. my $dnEntry = $LDAPconn->search(Param("LDAPBaseDN"),"subtree","uid=".$::FORM{"LDAP_login"}); if(!$dnEntry) { @@ -1274,13 +1289,7 @@ sub DumpBugActivity { sub GetCommandMenu { - my $loggedin = quietly_check_login(); - my $userid = 0; - if ( $::COOKIE{'Bugzilla_login'} ) { - $userid = DBname_to_id($::COOKIE{'Bugzilla_login'}); - } else { - $userid = 0; - } + my $userid = quietly_check_login() || 0; if (!defined $::anyvotesallowed) { GetVersionTable(); } @@ -1302,12 +1311,12 @@ Actions: | Reports }; - if ($loggedin) { + if ($userid) { if ($::anyvotesallowed) { $html .= " | My votes\n"; } } - if ($loggedin) { + if ($userid) { #a little mandatory SQL, used later on SendSQL("SELECT mybugslink, userid FROM profiles " . "WHERE login_name = " . SqlQuote($::COOKIE{'Bugzilla_login'})); diff --git a/mozilla/webtools/bugzilla/bug_form.pl b/mozilla/webtools/bugzilla/bug_form.pl index a89a75b3d10..f5d3cf90a2b 100644 --- a/mozilla/webtools/bugzilla/bug_form.pl +++ b/mozilla/webtools/bugzilla/bug_form.pl @@ -32,7 +32,7 @@ sub bug_form_pl_sillyness { my $zz; $zz = %::FORM; $zz = %::components; -# $zz = %::proddesc; + $zz = %::proddesc; $zz = %::prodmaxvotes; $zz = %::versions; $zz = @::legal_keywords; @@ -187,7 +187,8 @@ if (1 < @prodlist) { ""; } else { - $product_popup = $bug{'product'}; + $product_popup = $bug{'product'} . + ""; } print " diff --git a/mozilla/webtools/bugzilla/buglist.cgi b/mozilla/webtools/bugzilla/buglist.cgi index c4e44d96e59..79550cd4d85 100755 --- a/mozilla/webtools/bugzilla/buglist.cgi +++ b/mozilla/webtools/bugzilla/buglist.cgi @@ -55,7 +55,7 @@ my $serverpush = 0; ConnectToDatabase(); #print "Content-type: text/plain\n\n"; # Handy for debugging. -# $::FORM{'debug'} = 1; +#$::FORM{'debug'} = 1; if (grep(/^cmd-/, keys(%::FORM))) { diff --git a/mozilla/webtools/bugzilla/editusers.cgi b/mozilla/webtools/bugzilla/editusers.cgi index 71d57fba7e2..2724a4d1856 100755 --- a/mozilla/webtools/bugzilla/editusers.cgi +++ b/mozilla/webtools/bugzilla/editusers.cgi @@ -565,9 +565,9 @@ if ($action eq 'del') { CheckUser($user); # display some data about the user - SendSQL("SELECT realname FROM profiles + SendSQL("SELECT userid, realname FROM profiles WHERE login_name=" . SqlQuote($user)); - my $realname = FetchOneColumn(); + my ($theuserid, $realname) = FetchSQLData(); $realname ||= "missing"; print "
| Group set: | \n"; print ""; SendSQL("SELECT name - FROM groups + FROM groups, user_group_map + WHERE groups.group_id = user_group_map.group_id + AND user_group_map.user_id = $theuserid ORDER BY isbuggroup, name"); my $found = 0; while ( MoreSQLData() ) { diff --git a/mozilla/webtools/bugzilla/process_bug.cgi b/mozilla/webtools/bugzilla/process_bug.cgi index 5d60ce8f5a4..3fb2bc9f75a 100755 --- a/mozilla/webtools/bugzilla/process_bug.cgi +++ b/mozilla/webtools/bugzilla/process_bug.cgi @@ -126,6 +126,33 @@ if ( Param("strictvaluechecks") ) { ConnectToDatabase(); +# +# This function checks if there is a comment required for a specific +# function and tests, if the comment was given. +# If comments are required for functions is defined by params. +# +sub CheckonComment( $ ) { + my ($function) = (@_); + + # Param is 1 if comment should be added ! + my $ret = Param( "commenton" . $function ); + + # Allow without comment in case of undefined Params. + $ret = 0 unless ( defined( $ret )); + + if( $ret ) { + if (!defined $::FORM{'comment'} || $::FORM{'comment'} =~ /^\s*$/) { + # No comment - sorry, action not allowed ! + PuntTryAgain("You have to specify a comment on this " . + "change. Please give some words " . + "on the reason for your change."); + } else { + $ret = 0; + } + } + return( ! $ret ); # Return val has to be inverted +} + # Figure out whether or not the user is trying to change the product # (either the "product" variable is not set to "don't change" or the # user is changing a single bug and has changed the bug's product), @@ -135,8 +162,9 @@ if ( $::FORM{'id'} ) { SendSQL("SELECT product FROM bugs WHERE bug_id = $::FORM{'id'}"); $::oldproduct = FetchSQLData(); } -if ( ($::FORM{'id'} && $::FORM{'product'} ne $::oldproduct) - || (!$::FORM{'id'} && $::FORM{'product'} ne $::dontchange) ) { +if ((($::FORM{'id'} && $::FORM{'product'} ne $::oldproduct) + || (!$::FORM{'id'} && $::FORM{'product'} ne $::dontchange)) + && CheckonComment( "reassignbycomponent" )) { if ( Param("strictvaluechecks") ) { CheckFormField(\%::FORM, 'product', \@::legal_product); } @@ -510,33 +538,6 @@ sub ChangeResolution { } } -# -# This function checks if there is a comment required for a specific -# function and tests, if the comment was given. -# If comments are required for functions is defined by params. -# -sub CheckonComment( $ ) { - my ($function) = (@_); - - # Param is 1 if comment should be added ! - my $ret = Param( "commenton" . $function ); - - # Allow without comment in case of undefined Params. - $ret = 0 unless ( defined( $ret )); - - if( $ret ) { - if (!defined $::FORM{'comment'} || $::FORM{'comment'} =~ /^\s*$/) { - # No comment - sorry, action not allowed ! - PuntTryAgain("You have to specify a comment on this " . - "change. Please give some words " . - "on the reason for your change."); - } else { - $ret = 0; - } - } - return( ! $ret ); # Return val has to be inverted -} - foreach my $field ("rep_platform", "priority", "bug_severity", "summary", "component", "bug_file_loc", "short_desc", "product", "version", "op_sys", @@ -898,6 +899,8 @@ sub LogDependencyActivity { # Figure out what's really different... my ($removed, $added) = DiffStrings($oldstr, $newstr); LogActivityEntry($i,$target,$removed,$added); + # update timestamp on target bug so midairs will be triggered + SendSQL("UPDATE bugs SET delta_ts=NOW() WHERE bug_id=$i"); return 1; } return 0; @@ -1213,7 +1216,7 @@ The changes made were: if ( # the user wants to add the bug to the new product's group; ($::FORM{'addtonewgroup'} eq 'yes' || ($::FORM{'addtonewgroup'} eq 'yesifinold')) - # && GroupNameToId($oldhash{'product'}) & $oldhash{'groupset'})) + && GroupNameToId($oldhash{'product'}) # the new product is associated with a group; && GroupExists($::FORM{'product'}) diff --git a/mozilla/webtools/bugzilla/processmail b/mozilla/webtools/bugzilla/processmail index 56a0ed43c3d..48d18ac7fd6 100755 --- a/mozilla/webtools/bugzilla/processmail +++ b/mozilla/webtools/bugzilla/processmail @@ -1,4 +1,4 @@ -#!/usr/bonsaitools/bin/perl -wT +#!/usr/bonsaitools/bin/perl -w # -*- Mode: perl; indent-tabs-mode: nil -*- # # The contents of this file are subject to the Mozilla Public @@ -655,8 +655,6 @@ sub NewProcessOnePerson ($$$$$$$$$$$$) { return; } - detaint_natural($person); - SendSQL("SELECT userid FROM profiles WHERE login_name = " . SqlQuote($person)); my ($userid) = FetchOneColumn(); @@ -680,7 +678,7 @@ sub NewProcessOnePerson ($$$$$$$$$$$$) { my $save_id = $dep_id; detaint_natural($dep_id) || warn("Unexpected Error: \@depbugs contains a non-numeric value: '$save_id'") && return; - return unless CanSeeBug($dep_id, $userid, $groupset); + return unless CanSeeBug($dep_id, $userid); } my %mailhead = %defmailhead; diff --git a/mozilla/webtools/bugzilla/query.cgi b/mozilla/webtools/bugzilla/query.cgi index 354bf4bf363..668625ac0f4 100755 --- a/mozilla/webtools/bugzilla/query.cgi +++ b/mozilla/webtools/bugzilla/query.cgi @@ -247,7 +247,7 @@ foreach my $p (@::legal_product) { # If we're using bug groups to restrict entry on products, and # this product has a bug group, and the user is not in that # group, we don't want to include that product in this list. - next if (Param("usebuggroups") && GroupExists($p) && !UserInGroup($p, $userid)); + next if (Param("usebuggroups") && GroupExists($p) && !UserInGroup($userid, $p)); # We build up boolean hashes in the "-set" hashes for each of these things # before making a list because there may be duplicates names across products. diff --git a/mozilla/webtools/bugzilla/quicksearch.html b/mozilla/webtools/bugzilla/quicksearch.html index 900180065bf..df7e85ccf00 100644 --- a/mozilla/webtools/bugzilla/quicksearch.html +++ b/mozilla/webtools/bugzilla/quicksearch.html @@ -18,10 +18,8 @@ you may prefer this form. Type in one or more words (or word fragments) to search for: - - |