Friday, 2009-06-26

« Thursday, 2009-06-25 Index Saturday, 2009-06-27 »
../irclogs/#mantishelp.2009-06-26.log
--- scribe started ---00:00
ToffeePopsHi, For our mantis users, 'developers' can see private issues, 'updaters' cannot. Cool. So normally if a developer raises a private issue, an updater will not be able to see it.00:14
ToffeePopsBut if an updater raises an issue and the administrator decides to change the category and mark the issue private (wants the issue to be no longer visible to updaters), should the updater that originally raised the call still be able to see it?00:14
CIA-18Mantisbt: hickseydr * r5242a870ae53 /account_prefs_update.php: admin_site_threshold not needed to update prefs04:26
siebrandhola. Where'd the repo go (again)?07:40
dhx_mah it's dead again?07:43
dhx_mwas going to do some work :D07:43
siebranddhx_m: same here; want to push L10n updates07:50
mantisbotNew bug: Bug 10627 - dhx - open - assigned09:36
mantisbotNew bug: Ensure all forms use CSRF protection - http://www.mantisbt.org/bugs/view.php?id=1062709:36
CIA-18Mantisbt: hickseydr * r13939d6549d8 / (.gitignore core.php): Deprecate use of custom_constant_inc.php09:39
nuclear_eclipsemorning all12:37
dhx_mhey12:42
dhx_mthis CSRF stuff is not going to be easy to fix12:49
nuclear_eclipsewhy not?12:50
dhx_mbecause the form code is not purged when an error is encountered at the target script12:50
nuclear_eclipsethat's the whole point :P12:51
dhx_mso you can have lots of form codes lingering around per user for up to 3 days12:51
nuclear_eclipsethat doesn't need fixing -- that's all by design...12:51
dhx_myeah I understand the reason why it isn't purged straight off the bat12:51
dhx_mI take it that it is OK for a user to have loads of forgotten form codes then?12:51
nuclear_eclipseyep12:52
dhx_mok12:52
dhx_mwell in that case I'm about 50% through fixing all instances of <form> to have a form security field attached12:53
dhx_mno idea why this wasn't done before... easy work for big gains :)12:53
nuclear_eclipsedo note that not all forms need csrf12:53
dhx_many form that modifies data would though I guess12:54
nuclear_eclipseonly forms that result in some sort of actual destructive/secure change to the system12:54
dhx_myep12:54
nuclear_eclipseeg, filters form doesn't need csrf12:54
dhx_myep12:54
nuclear_eclipsek12:54
dhx_myeah if it was done for filters you'd probably end up caching a LOT of unused codes ;)12:55
nuclear_eclipseand it probably never happened because I had about 10 million other things on my plate and never got past the initial rollout in order to take care of the initial security issues12:56
nuclear_eclipseeg, like creating users with admin privileges12:56
nuclear_eclipsewell, assuming that filters would rarely "error", it would purge most of the codes, but it would be extra work on the server for no reason12:57
nuclear_eclipsebut anywho...12:58
nuclear_eclipseany work you do for this should definitely go into 1.2, and likely 1.1 if it ports easily12:59
nuclear_eclipseconsidering that CSRF prevention *is* a security issue :P12:59
dhx_mok12:59
dhx_myep12:59
dhx_mwe could release 1.1.9 after these fixes are made13:00
nuclear_eclipseprobably13:00
dhx_mI doubt there are going to be any other obvious security problems... I'm looking as I go13:00
nuclear_eclipsethankfully, these days we have automated scripts for building a full release :P13:00
dhx_mnice :)13:01
nuclear_eclipseyeah, that's the mantisbt-dev.git repo btw, nothing but external scripts for building docbooks, building releases, checking language strings, etc13:01
dhx_mcool13:02
dhx_mbtw any reason the CSRF timeout is a whopping 3 days?13:02
dhx_min case someone takes 3 days to fill out a form? :p13:02
nuclear_eclipseyep13:02
dhx_mI'd hope that user isn't running Windows ME then... :D13:03
nuclear_eclipseStart a form friday right before end of working hours, and the form token is still valid monday morning when you get back in to work13:03
dhx_mhmmm not a bad idea I suppose13:04
nuclear_eclipseyeah, I'm good like that ;)13:04
nuclear_eclipseand modest, to boot!13:05
dhx_msomeone has obviously been caught out with expiring CSRF tokens before on a form that took a long time to fill in :p13:05
dhx_mhaha13:05
dhx_mwell I'll be back in about an hour13:05
nuclear_eclipseok, cheers13:05
dhx_mthis branch I'm making will be quite funny because I'm averaging 4 lines of really code per hour13:06
nuclear_eclipselol13:06
dhx_m-really13:06
dhx_mjust doing it in spare seconds13:06
dhx_manyhow, brb :)13:06
[KK]Kirillhi all13:21
nuclear_eclipsehowdy13:24
[KK]Kirillnice13:25
[KK]Kirillwhat's new?13:25
mantisbotNew bug: Bug 10628 - klugmantisadmin - open - new13:27
mantisbotNew bug: Lost Password feature does not send eMail - http://www.mantisbt.org/bugs/view.php?id=1062813:27
nuclear_eclipsenot much13:30
[KK]Kirillwho know where siebrand?14:20
[KK]KirillI don't see some days14:21
dhx_m[KK]Kirill: he came in here a few hours ago to complain about git being offline :p14:23
nuclear_eclipsedhx_m: did you break something?15:33
dhx_mnuclear_eclipse: oh :o15:37
dhx_mnuclear_eclipse: what happened?15:37
dhx_mnuclear_eclipse: custom_constant_inc.php no longer exists in 1.3? :p15:37
nuclear_eclipsegetting a whole bunch of errors regarding user_get_field...15:39
* nuclear_eclipse pastes15:39
nuclear_eclipsehttp://mantis.pastebin.com/d4952e1a415:39
dhx_mOOOPS15:40
nuclear_eclipseWHAT DID YOU DO?!15:40
nuclear_eclipseOMG, HE'S DYING!!!!1115:41
dhx_mlol15:41
CIA-18Mantisbt: hickseydr * r06f0cfba5dd6 /core/user_api.php: Missing parameter to user_get_field15:43
dhx_mhow embarassing... you15:43
dhx_myou'd think I didn't test that one first lol15:43
dhx_mjust goes to show you have to test even the simplest things15:44
nuclear_eclipsedhx_m: it's only, we'll only make fun of you for a few days :P15:45
dhx_mlol15:45
mantisbotNew bug: Bug 10629 - najina - open - new17:03
mantisbotNew bug: Related to 9576 - http://www.mantisbt.org/bugs/view.php?id=1062917:03
paul_moo17:26
nuclear_eclipsehowdy17:27
paul_so how am i spending my weekend17:27
paul_dhx_m: i think you might miss the point of the bug17:31
nuclear_eclipsepaul_: finish fixing SOAP API?17:32
dhx_mpaul_: ?17:32
paul_hi17:32
paul_nuclear_eclipse: could do17:32
dhx_mhey17:32
paul_your list mail17:32
dhx_misn't the problem that he's getting a history of 400+ modifications of the bug sent to him?17:33
paul_I thouhgt the problem might be we allow users to limit bugnotes17:34
paul_and iirc specify the order17:34
paul_therefore, if you limit it to 5 with oldest first17:34
paul_what happens? ;/17:34
paul_iirc, the limit or order thing was broken and got fixed17:34
paul_I might be wrong here17:35
nuclear_eclipseyeah, I fixed that17:35
dhx_mI'm confused now :p17:35
dhx_mI'll leave it up to you :D17:35
paul_nooononoo17:35
dhx_mhaha17:35
paul_dhx_m: you can configure how many bugnotes17:35
paul_you get in email notifications17:35
dhx_moh you already can... oops :)17:35
paul_dhx_m:  you can also configure newest/oldest first17:35
paul_therefore17:35
paul_if you configure a limit of 10 and oldest first17:35
nuclear_eclipsehowever, you can't specify a limit on history entries...17:36
paul_you'd potentially get the '2006 issues' and not see the newest bugnote17:36
paul_I see17:36
dhx_mah good, so I wasn't wrong :p17:36
nuclear_eclipseand no17:36
nuclear_eclipseyou'll always get the X latest bugnotes17:36
paul_does mantis feel faster?17:36
nuclear_eclipseregardless of order you request, you'll always get the latest bugnotes17:36
nuclear_eclipsethey'll just show in a different order17:37
nuclear_eclipsethe real problem with receiving notifications for 4286 is the absolutely gigantic history log associated with it...17:37
paul_:)17:37
* paul_ downloads php5.3.0 final17:38
nuclear_eclipsewhich is something I've been investigating changing -- perhaps to match the setting of how many bugnotes you receive17:38
nuclear_eclipseeg, if you ask for only the five latest bugnotes, you should only get history entries starting from the first bugnote in the set that you receive17:39
nuclear_eclipseso, eg, if the last five bugnotes were posted in may, then you'd only receive history entries from may forward17:39
nuclear_eclipseany thoughts from you two on that idea?17:41
CIA-18Mantisbt: s.mazeland * rf180b7a71b12 / (21 files in 4 dirs): Localisation updates from http://translatewiki.net (2009-06-26 07:29 UTC)17:43
CIA-18Mantisbt: s.mazeland * rbbc99b420bf0 / (4 files in 2 dirs): Merge branch 'master' of git://mantisbt.org/mantisbt17:43
paul_nuclear_eclipse: I defer17:43
siebrandcan someone please merge rf180b7a71b12 into the 1.2 branch?17:45
paul_sure ask nuclear_eclipse :)17:45
nuclear_eclipsesiebrand: got it17:46
dhx_mbug #10000 lol17:46
mantisbotBug 10000 - anusha - open - new17:46
mantisbotHow to  get users list  in "Assigned To" field - http://www.mantisbt.org/bugs/view.php?id=1000017:46
dhx_msomeone attached a screenshot inside a powerpoint presentation17:47
CIA-18Mantisbt: s.mazeland master-1.2.x * rf198b1ce4baa / (21 files in 4 dirs): Localisation updates from http://translatewiki.net (2009-06-26 07:29 UTC)17:47
nuclear_eclipsedhx_m: facepalm17:47
dhx_mI'm triaging old stuff at the moment17:47
nuclear_eclipseI swear, everytime I see someone attach a "screenshot" insed of a word or powerpoint document, I was to reach through the internet and make sure that person can never reproduce17:47
paul_:)17:48
paul_so erm17:48
dhx_mlol17:48
paul_whats the plan now17:48
paul_work on mantis1.2.117:48
paul_:)17:48
paul_new features!17:48
nuclear_eclipseno, work on mantis 1.2.017:48
dhx_mshouldn't 1.2.x only contain bug fixes?17:48
nuclear_eclipsewe haven't officially released 1.2 yet :P17:48
dhx_m1.3.x for features?17:48
paul_we've not named our next release yet17:49
dhx_mI'll have a 1.1.9 :p17:49
paul_could make a soap client17:49
paul_for mantis17:49
dhx_msomething to help us test SOAP would be great17:49
paul_26th june today17:50
paul_what time is it in amercia atm?17:51
nuclear_eclipse1:51pm here17:51
dhx_mpaul_: bug #9996... DESTROY all meta refresh!17:52
mantisbotBug 9996 - nuscly - open - new17:52
mantisbotError 500 in apache when creating a new bug or updating a bug status / file : bug_update.php - http://www.mantisbt.org/bugs/view.php?id=999617:52
paul_hmm?17:52
dhx_mmeta refresh = bad17:52
paul_no17:52
dhx_myep, we should send a 302 response instead17:52
nuclear_eclipseno17:53
paul_you dont want to fiddle17:53
paul_you really dont17:53
nuclear_eclipsewe use meta refreshes for specific purposes17:53
nuclear_eclipsewe use 302's for everything else17:53
dhx_mwell I haven't looked into it too much... ah ok17:53
dhx_mthat's fine :)17:53
dhx_mI thought it was widespread17:53
dhx_m... just scraping for things to do17:53
nuclear_eclipsemeta refreshes provide a delay for making the page auto-refresh, eg, my view page17:53
nuclear_eclipseand tbh, I don't want to know what that guy is doing to cause that error...17:54
dhx_mlol17:54
paul_resolve17:54
paul_not a bug17:54
paul_btw, we doing rc1 at a slightly bad time17:55
nuclear_eclipsewhy's that?17:55
paul_php5.3.0 is tuesday17:55
paul_so new 3rd party libs17:55
nuclear_eclipseI don't see how that could mean rc1 is at a bad time?17:56
nuclear_eclipsewe're not going to rely on 5.3 features...17:56
nuclear_eclipseafk17:56
nuclear_eclipseback17:58
nuclear_eclipsethought I was gonna have to go to a meeting...17:59
nuclear_eclipsehi giallu18:09
CIA-18Mantisbt: paul * rb20a43a76a5a /library/ (89 files in 7 dirs): Update adodb to 5.09a18:22
nuclear_eclipsepaul_: does that adodb update fix anything that would be important to have in 1.2?18:40
paul_probably not18:46
mantisbotNew bug: Bug 10630 - darthmal - open - new18:53
mantisbotNew bug: Mantis successfully installed on mubuntu 192.168.0.31 - http://www.mantisbt.org/bugs/view.php?id=1063018:53
paul_?18:53
paul_hi giallu20:00
eqnerdhi all...so I'm a bit confused, there's this wiki page (http://www.mantisbt.org/wiki/doku.php/mantisbt:issue_voting_requirements?s=vote) claiming that voting exists and is done, and yet I don't see any of the database tables, configs, etc, and there seems to be no "here, it's a module/plugin" text, or "check it out in release ____"....anyone have any ideas?22:19
paul_dhx_m: you gone?23:06
« Thursday, 2009-06-25 Index Saturday, 2009-06-27 »

Generated by irclog2html.py