| ../irclogs/#mantishelp.2009-06-27.log | ||
| --- scribe started --- | 00:00 | |
| mantisbot | New bug: Bug 10631 - j-b-m - open - new | 00:10 |
|---|---|---|
| mantisbot | New bug: bug_graph_page.php missing from Graph plugin - http://www.mantisbt.org/bugs/view.php?id=10631 | 00:10 |
| [KK]Kirill | siebrand: lo | 05:48 |
| [KK]Kirill | look http://github.com/jamespadolsey/prettyPrint.js/tree/master | 06:50 |
| CIA-18 | Mantisbt: paul * rab73c5176704 /plugins/MantisGraph/pages/ (3 files): Fix #0010631: bug_graph_page.php missing from Graph plugin | 11:09 |
| [KK]Kirill | hi paul_ | 13:35 |
| paul_ | lo | 13:35 |
| [KK]Kirill | I don't understand, how I missed bug with jpGraph | 13:36 |
| [KK]Kirill | :) | 13:36 |
| paul_ | ? | 13:37 |
| [KK]Kirill | > Mantisbt: paul * rab73c5176704 /plugins/MantisGraph/pages/ (3 files): Fix #0010631: bug_graph_page.php missing from Graph plugin | 13:37 |
| [KK]Kirill | and git.mantisforge.org not sync mantisbt.git | 13:39 |
| dhx_m | hi | 13:41 |
| paul_ | lo | 13:43 |
| dhx_m | you were asking for me yesterday? :) | 13:44 |
| paul_ | yep | 13:44 |
| paul_ | you wasn'th ere | 13:44 |
| dhx_m | that's a surprise :p | 13:44 |
| dhx_m | I'm always here lol | 13:44 |
| [KK]Kirill | paul_: thnx | 13:47 |
| paul_ | dhx_m: need to set up a box running oracle/mssql/postgres/db2 | 13:52 |
| dhx_m | is oracle free to get? | 13:53 |
| dhx_m | I think there is a free version of mssql at least | 13:53 |
| paul_ | http://www.mantisbt.org/bugs/view.php?id=7702 | 13:53 |
| paul_ | http://www.mantisbt.org/bugs/view_all_bug_page.php?filter=3258140 | 13:53 |
| dhx_m | oh we must store a copy of the version in the bug table... rather than a reference to the version number? | 13:54 |
| dhx_m | this doesn't make sense to me | 13:54 |
| dhx_m | I thought renaming worked ok? | 13:54 |
| paul_ | i think we store version name in bug table | 13:54 |
| dhx_m | because we stored it as a reference to a version ID? | 13:54 |
| dhx_m | ugh | 13:55 |
| dhx_m | we do :( | 13:55 |
| paul_ | maybe update database schema | 13:56 |
| paul_ | could be fun! | 13:56 |
| dhx_m | yep that is a good one to fix | 13:56 |
| dhx_m | good find from the archives :) | 13:56 |
| paul_ | nah | 13:56 |
| paul_ | I look for topics | 13:56 |
| dhx_m | I just marked it as confirmed | 13:56 |
| dhx_m | yep I was trying to triage some stuff yesterday | 13:56 |
| paul_ | I find it better to | 13:56 |
| dhx_m | found something like 10 duplicates between 2 bug reports | 13:56 |
| paul_ | pick a summary topic | 13:56 |
| paul_ | e.g. | 13:56 |
| paul_ | csv | 13:56 |
| paul_ | or whatever | 13:57 |
| dhx_m | yep | 13:57 |
| dhx_m | in fact I say don't update the schema... | 13:57 |
| dhx_m | what we really need is the ability to target multiple versions | 13:57 |
| dhx_m | 1.1.x, 1.2.x and 1.x.x in our case if a new security flaw is found | 13:58 |
| dhx_m | although one could argue that you should create a ticket for each version? | 13:58 |
| paul_ | i'm also wondering | 13:58 |
| paul_ | where we have bugs | 13:58 |
| paul_ | e.g. 10435 | 13:58 |
| paul_ | whether we should resolve as 'create a plugin' | 13:58 |
| dhx_m | agreed | 14:00 |
| dhx_m | plus the user interface in the screenshot sucks (no offence) | 14:00 |
| dhx_m | I'd like to see Mantis become more modular, so you can simply turn stuff off if you don't want to use it | 14:01 |
| dhx_m | it isn't going to really cause many more maintenance problems that we'd already get | 14:01 |
| dhx_m | because there are already parts of Mantis that aren't maintained well | 14:01 |
| dhx_m | for instance, when was the last time you used the minmap/freemind export thingys? | 14:02 |
| paul_ | they are plugins... | 14:14 |
| dhx_m | oh heh | 14:19 |
| dhx_m | good point | 14:19 |
| dhx_m | nuclear_eclipse: good post | 14:46 |
| paul_ | ? | 14:46 |
| dhx_m | on the mailing list he pointed out http://groups.google.com/group/make-the-web-faster/browse_thread/thread/ddfbe82dd80408cc | 14:47 |
| paul_ | dhx_m: so coding today or? | 15:21 |
| dhx_m | paul_: yep fixing CSRF | 15:22 |
| dhx_m | getting there :) | 15:22 |
| dhx_m | I'm making it so that we can grep -RniA1 "<form" in the future to quickly see if CSRF is missing off a form | 15:23 |
| paul_ | erm | 15:24 |
| paul_ | well, I said before | 15:24 |
| paul_ | we should have a form_start command | 15:24 |
| paul_ | john didn't like that idea | 15:24 |
| dhx_m | not every form needs CSRF though | 15:24 |
| paul_ | sure but can't we just add for sake of it? | 15:25 |
| dhx_m | if I'm right... every time a CSRF form is printed but not submitted, a token is kept in the session for up to 3 days? | 15:25 |
| paul_ | hmm | 15:25 |
| dhx_m | this makes it a problem for say the sponsorship form... or the one click buttons on the bug view page | 15:25 |
| dhx_m | to assign, move, copy, delete, stick, etc | 15:26 |
| paul_ | they go to a confirmation page mostly | 15:26 |
| dhx_m | unless we change it so that these security tokens last 10 minutes | 15:27 |
| dhx_m | actually that wouldn't work either | 15:27 |
| dhx_m | you may have the bug open for 3 days in a browser window and THEN click a button to find CSRF fails | 15:27 |
| dhx_m | maybe what we need instead is a sort of "captcha" page | 15:28 |
| paul_ | eww :P | 15:28 |
| paul_ | (after 10 minutes) | 15:28 |
| dhx_m | so if CSRF is expired... you have the opportunity to confirm the action | 15:28 |
| dhx_m | a bit too much effort though | 15:29 |
| dhx_m | a better idea might be to change how CSRF works | 15:31 |
| dhx_m | so instead of making unique hashes each time, we use a challenge-response approach | 15:32 |
| dhx_m | wait maybe it's not challenge response | 15:33 |
| dhx_m | let me figure it out | 15:33 |
| dhx_m | server sends nonce and hash(nonce+userid+secret) as hidden form fields | 16:16 |
| dhx_m | client returns this value with the submitted form | 16:16 |
| dhx_m | server knows secret and userid and uses nonce from client to recalculate and compare hash(nonce+userid+secret) | 16:16 |
| dhx_m | that doesn't really help with anonymous form submission | 16:17 |
| dhx_m | maybe it'd be better to use session_id for anonymous users | 16:18 |
| dhx_m | and also to strengthen it a bit more... replace userid+secret with a per-user secret | 16:18 |
| dhx_m | actually maybe use the session id/hash for registered users too... if you understand that "logout" will effectively prevent you from submitting a form | 16:28 |
| dhx_m | (that hasn't already been submitted) | 16:28 |
| paul_ | dhx_m: we should aim to resolve 10 issues a day or something | 16:51 |
| dhx_m | paul_: each? and code fixes... or just closing old tickets on the tracker? | 16:51 |
| paul_ | whatever :) | 16:51 |
| paul_ | I do think we need to housekeep a bit more | 16:52 |
| dhx_m | I like that idea :0 | 16:52 |
| dhx_m | :) | 16:52 |
| paul_ | I like summary to be green at all times ;p | 16:52 |
| dhx_m | :) | 16:52 |
| paul_ | at the moment | 16:52 |
| paul_ | 180 days = +78 | 16:52 |
| dhx_m | yeah | 16:53 |
| dhx_m | we should aim to get that number to a nice value :) | 16:53 |
| dhx_m | -67 in 30 days is good | 16:53 |
| dhx_m | could be a lot better though given our huge backlog | 16:53 |
| paul_ | bug 10066 | 16:54 |
| mantisbot | Bug 10066 - mmger - open - new | 16:54 |
| mantisbot | g_allow_reporter_close has no effect - http://www.mantisbt.org/bugs/view.php?id=10066 | 16:54 |
| * paul_ ponders | 16:54 | |
| paul_ | having grepped code confused a bit | 16:54 |
| dhx_m | would it be harsh to reply "PEBKAC" on bug 10340 | 16:54 |
| mantisbot | Bug 10340 - Naima - open - new | 16:54 |
| mantisbot | Https on Mantis - http://www.mantisbt.org/bugs/view.php?id=10340 | 16:54 |
| paul_ | pebkac? | 16:54 |
| dhx_m | problem exists between keyboard and chair | 16:55 |
| paul_ | resolve politely | 16:55 |
| paul_ | iirc we use relative links | 16:55 |
| dhx_m | I have no problem using Mantis via secure HTTP | 16:56 |
| dhx_m | so it isn't a case of Mantis spitting out http:// links and not respecting the protocol actually being used | 16:56 |
| dhx_m | lol at some issues saying they've been open for 2700+ days | 17:01 |
| dhx_m | is there a better way of doing what captcha does... that isn't captcha? | 17:09 |
| dhx_m | they're useless thesedays | 17:09 |
| dhx_m | not just useless... but dangerous to usability | 17:09 |
| mantisbot | New bug: Bug 10632 - dhx - open - new | 18:27 |
| mantisbot | New bug: Cannot update global default columns - project 0 not found - http://www.mantisbt.org/bugs/view.php?id=10632 | 18:27 |
| mantisbot | New bug: Bug 10633 - Mr Papa - open - new | 19:33 |
| mantisbot | New bug: Product Version in View Issues Trashed After 1.2.0rc1 Upgrade - http://www.mantisbt.org/bugs/view.php?id=10633 | 19:33 |
| paul_ | repo'd | 19:35 |
| paul_ | dhx_m: still here? | 20:55 |
| mantisbot | New bug: Bug 10634 - RavenWebServices - open - new | 22:29 |
| mantisbot | New bug: Fixed In Version in View Issues reads @fixed_in_version@ After 1.2.0rc1 Upgrade - http://www.mantisbt.org/bugs/view.php?id=10634 | 22:29 |
| CIA-18 | Mantisbt: paul * r938f67c1e206 /core/bug_api.php: Fix Issue #0010634: Fixed In Version in View Issues reads @fixed_in_version@ After 1.2.0rc1 Upgrade | 22:56 |
Generated by irclog2html.py