| ../irclogs/#mantishelp.2009-07-01.log | ||
| --- scribe started --- | 00:00 | |
| CIA-16 | Mantisbt: vboctor * ree1ac756fbb9 /config_defaults_inc.php: Fixes #5012: Comments relating to . | 01:49 |
|---|---|---|
| dhx_m | hi | 02:01 |
| CIA-16 | Mantisbt: hickseydr * rc2ef5a6cdee3 / (api/soap/mc_issue_api.php bug_update.php): Fix #10647: check permissions before updating target_version | 02:23 |
| CIA-16 | Mantisbt: hickseydr * r0cfb73e926a5 /core/bug_api.php: Don't require access check for fixed_in_version | 02:31 |
| CIA-16 | Mantisbt: hickseydr * r881305a76f46 / (bug_change_status_page.php bug_report_advanced_page.php): Remove offtopic uses of handle_bug_threshold | 02:51 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * rad56aaa803d1 / (api/soap/mc_issue_api.php bug_update.php): Fix #10647: check permissions before updating target_version | 02:54 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * r87a5dc26d91d /core/bug_api.php: Don't require access check for fixed_in_version | 02:54 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * r75b4f76a8919 / (bug_change_status_page.php bug_report_advanced_page.php): Remove offtopic uses of handle_bug_threshold | 02:54 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * r941a82ccd8df / (3 files): Fix #10623: typo in $g_reminder_recipents_monitor_bug | 02:58 |
| CIA-16 | Mantisbt: hickseydr * racbfce3bd3aa / (3 files): Fix #10623: typo in $g_reminder_recipents_monitor_bug | 02:59 |
| CIA-16 | Mantisbt: hickseydr * rc564f4e97394 /manage_config_columns_set.php: Fix #10632: cannot update columns global defaults | 03:12 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * raf99051860ac /manage_config_columns_set.php: Fix #10632: cannot update columns global defaults | 03:12 |
| [KK]Kirill | paul_: hi | 06:11 |
| brianstv | Hi | 06:11 |
| [KK]Kirill | brianstv: lo | 06:11 |
| [KK]Kirill | paul_: check git.mantisforge.org | 06:12 |
| [KK]Kirill | not sync with git.mantisbt.org | 06:12 |
| * siebrand mumbles something about the fracking repo. | 06:43 | |
| [KK]Kirill | giallu: hi | 07:25 |
| [KK]Kirill | giallu: whats repo address for mantisbt.git on git.mantisbt.org? | 07:26 |
| giallu | do you mean to clone the repo? | 07:27 |
| [KK]Kirill | yes | 07:29 |
| [KK]Kirill | in git.mantisforge.org show how I can clone | 07:29 |
| [KK]Kirill | in mantisbt.org - not | 07:29 |
| giallu | we need to add the same info there... | 07:30 |
| giallu | nuclear_eclipse, can you add those info? | 07:32 |
| [KK]Kirill | giallu: For me I use PhpGit and they show this info | 07:33 |
| dhx_m | hi | 07:40 |
| giallu | dhx_m, hi | 07:41 |
| dhx_m | [KK]Kirill: can you please try reproducing 10663 with $g_show_detailed_errors = ON | 07:42 |
| dhx_m | giallu: hi | 07:42 |
| [KK]Kirill | dhx_m: lo | 07:45 |
| [KK]Kirill | dhx_m: I think no. | 07:50 |
| [KK]Kirill | dhx_m: sorry. can | 07:51 |
| [KK]Kirill | one sec | 07:51 |
| [KK]Kirill | dhx_m, giallu what link to clone repo? | 07:52 |
| dhx_m | [KK]Kirill: thanks | 07:52 |
| [KK]Kirill | dhx_m: I get | 07:54 |
| [KK]Kirill | one sec | 07:55 |
| giallu | [KK]Kirill, can't rememeber, chancesa re it's documented in the wiki | 07:56 |
| [KK]Kirill | https://sp.vester.ru/pastebin/pastebin.php?show=30 | 07:56 |
| [KK]Kirill | giallu: ok | 07:56 |
| dhx_m | [KK]Kirill: thanks | 07:58 |
| dhx_m | [KK]Kirill: http://docs.mantisbt.org/master/en/developers/dev.contrib.clone.html | 08:00 |
| dhx_m | add an extra argument to the end of those commands to specify the name of the directory to which the repository will be stored locally | 08:00 |
| [KK]Kirill | dhx_m: thanks | 08:01 |
| CIA-16 | Mantisbt: hickseydr * r20b339b6c6c1 /core/obsolete.php: Update obsolete.php after rename of $g_reminder_recipents_monitor_bug rename | 08:08 |
| [KK]Kirill | John git clone git://mantisbt.org/mantisbt.git ./ | 08:13 |
| [KK]Kirill | mantisbt.org[0: 209.20.94.10]: errno=Invalid argument | 08:13 |
| [KK]Kirill | fatal: unable to connect a socket (Invalid argument) | 08:13 |
| [KK]Kirill | nuclear_eclipse: it's from http://docs.mantisbt.org/master/en/developers/dev.contrib.clone.html | 08:14 |
| konnertz_ | hi all. I setup ldap auth yesterday. That's fine but of course the former user accounts are not available now. Specially i need the admin account. How ist this done? | 08:15 |
| [KK]Kirill | You must set for one accaunt admins right :) | 08:16 |
| dhx_m | [KK]Kirill: lose the trailing slash? | 08:16 |
| konnertz_ | are the ldap accounts mapped to user table, so the permission nums are available? | 08:16 |
| dhx_m | [KK]Kirill: also any idea how I can reproduce that error? | 08:16 |
| [KK]Kirill | dhx_m: yes | 08:17 |
| dhx_m | [KK]Kirill: select a few issues, and perform an action on all of them? | 08:17 |
| [KK]Kirill | see private | 08:18 |
| konnertz_ | [KK]Kirill, set the admin rights ... in LDAP? | 08:19 |
| konnertz_ | brb | 08:20 |
| brianstv | Seems the git service at git://mantisbt.org/mantisbt.git is down. | 08:20 |
| brianstv | doing a 'git pull' returns | 08:20 |
| brianstv | git.mantisbt.org[0: 209.20.94.10]: errno=Connection refused | 08:20 |
| brianstv | fatal: unable to connect a socket (Connection refused) | 08:20 |
| vb1231 | brianstv: doesn git clone work? | 08:21 |
| [KK]Kirill | konnertz_: not. log in mantis | 08:21 |
| brianstv | I get the same error. | 08:21 |
| [KK]Kirill | change auth to default | 08:21 |
| [KK]Kirill | vb1231: hi Victor | 08:22 |
| vb1231 | Hi Kirill | 08:22 |
| dhx_m | vb1231: hi | 08:22 |
| vb1231 | brianstv: I got the same error earlier today. I tried the git@mantisbt.org which is for devs and it worked fine. You might want to ping nuclear_eclipse | 08:23 |
| vb1231 | hi dhx_m | 08:23 |
| [KK]Kirill | nuclear_eclipse sleap | 08:23 |
| [KK]Kirill | sleep | 08:23 |
| brianstv | I'll try again tomorrow, Thanks. | 08:24 |
| vb1231 | good luck | 08:24 |
| [KK]Kirill | Victor, git@mantisbt.org may be work | 08:24 |
| [KK]Kirill | but git://mantisbt.org/mantisbt.git not work | 08:25 |
| [KK]Kirill | vb1231: for git@mantisbt.org:mantisbt.git I must be developer | 08:25 |
| vb1231 | yes | 08:26 |
| vb1231 | checkout the developers manual for details. | 08:26 |
| vb1231 | John has documented the use of both options. | 08:26 |
| [KK]Kirill | vb1231: http://docs.mantisbt.org/master/en/developers/dev.contrib.clone.html | 08:26 |
| vb1231 | yep, that's it. | 08:28 |
| vb1231 | any mac user around? | 08:29 |
| vb1231 | I can't compile MantisBT docbook... tells me "jw" command not found. | 08:29 |
| vb1231 | I've installed docbook toolset + openjade via macports | 08:29 |
| konnertz_ | brb | 08:42 |
| dhx_m | vb1231: I haven't tried compiling docbook yet myself | 08:44 |
| konnertz_ | re | 08:50 |
| [KK]Kirill | konnertz_: ro | 08:51 |
| konnertz_ | pls how did you mean...? you said sth like "not. log in to mantis" | 08:52 |
| konnertz_ | Can a usertable-based account with own credentials beside ldap exist or not? | 08:53 |
| [KK]Kirill | konnertz_: When you login throu ldap created accaunt | 08:54 |
| [KK]Kirill | change auth to default and login as administartor | 08:54 |
| konnertz_ | yep, then? | 08:54 |
| [KK]Kirill | set admins right to this accaunt | 08:54 |
| konnertz_ | ah ok | 08:54 |
| konnertz_ | ok i logged in again via md5 as admin and now i've seen that user management ui | 09:02 |
| konnertz_ | i have set an account to have admin rights. | 09:02 |
| konnertz_ | This admin has to be in ldap right? | 09:03 |
| [KK]Kirill | konnertz_: not | 09:05 |
| * [KK]Kirill slaps paul_ around a bit with a large trout | 09:35 | |
| * [KK]Kirill slaps nuclear_eclipse around a bit with a large trout | 12:16 | |
| nuclear_eclipse | morning all | 12:48 |
| nuclear_eclipse | [KK]Kirill: I just kicked the git-daemon, so you should be able to clone now | 12:49 |
| dhx_m | nuclear_eclipse: hi | 12:53 |
| [KK]Kirill | nuclear_eclipse: hi | 12:54 |
| [KK]Kirill | Thanks | 12:54 |
| [KK]Kirill | nuclear_eclipse: what's about sync to mantisforge.org? | 12:55 |
| nuclear_eclipse | ask paul_ :P | 12:55 |
| [KK]Kirill | ok | 12:55 |
| [KK]Kirill | nuclear_eclipse: did you know python? | 12:56 |
| nuclear_eclipse | yep | 12:56 |
| dhx_m | nuclear_eclipse: so what did we decide with CSRF tokens (because my CSRF branch is causing my PHP session file to grow very quickly with unused tokens :D) | 12:57 |
| [KK]Kirill | Not, forget | 12:57 |
| dhx_m | nuclear_eclipse: create a random hash stored in SESSION | 12:57 |
| dhx_m | nuclear_eclipse: and then hash that with the form name to produce a form token? | 12:58 |
| nuclear_eclipse | dhx_m: I was going to work on it, and then I spent the last day or in a meeting and filling out paperwork to buy a home | 12:58 |
| dhx_m | nuclear_eclipse: ah ok, no pressure :) | 12:58 |
| dhx_m | nuclear_eclipse: and congratulations on the new home! | 12:58 |
| nuclear_eclipse | thanks | 12:59 |
| dhx_m | does it have turrets? | 12:59 |
| dhx_m | (stupid question of the day :p) | 12:59 |
| nuclear_eclipse | just got to finish the mortgage paperwork now, wait a couple weeks, travel two states over to close on the mortgage, return, and then move everything that following weekend :P | 13:00 |
| nuclear_eclipse | no, it's a townhouse, so no turrets... yet ;) | 13:00 |
| nuclear_eclipse | my favorite part is that it's a condo, so I can continue to not do any yard work :P | 13:01 |
| dhx_m | paperwork fun | 13:01 |
| dhx_m | haha | 13:01 |
| paul_ | 14:07 < [KK]Kirill> nuclear_eclipse: what's about sync to mantisforge.org? | 13:09 |
| paul_ | 14:07 < nuclear_eclipse> ask paul_ :P | 13:09 |
| paul_ | git daemon wasn't running on git.mantisbt.org | 13:09 |
| nuclear_eclipse | right | 13:10 |
| nuclear_eclipse | I fixed that | 13:10 |
| nuclear_eclipse | or at least until the next restart... | 13:10 |
| paul_ | I might add mantisbt.org to my server monitoring | 13:10 |
| nuclear_eclipse | ok, I think I got the git-daemon setup with init/rc correctly now, so it *should* start on server boot | 13:14 |
| [KK]Kirill | dhx_m, nuclear_eclipse, paul_: anyone can see bug 10494? | 13:14 |
| paul_ | bug 10494 | 13:14 |
| dhx_m | mantisbot died a few days ago :p | 13:14 |
| paul_ | bug 10494 | 13:15 |
| [KK]Kirill | http://www.mantisbt.org/bugs/view.php?id=10494 | 13:15 |
| paul_ | bug 10494 | 13:15 |
| paul_ | :( | 13:15 |
| dhx_m | I did see that | 13:15 |
| [KK]Kirill | who kill mantisbot | 13:15 |
| nuclear_eclipse | R.I.P. MantisBot, 2008-2009... :'( | 13:15 |
| [KK]Kirill | dhx_m: what do you think? | 13:15 |
| * nuclear_eclipse yells at giallu | 13:15 | |
| [KK]Kirill | In FF 3.5 this problem too | 13:16 |
| paul_ | the problem is just the last screenshot right? | 13:16 |
| [KK]Kirill | I can create new screenshot | 13:16 |
| [KK]Kirill | yes | 13:16 |
| dhx_m | I'll attach a sample file | 13:16 |
| dhx_m | file icon 海納百川.海納百川 [^] (13 bytes) 2009-07-01 09:17 [Delete] | 13:17 |
| [KK]Kirill | %E6%B5%B7%E7%B4%8D%E7%99%BE%E5%B7%9D.%E6%B5%B7%E7%B4%8D%E7%99%BE%E5%B7%9D | 13:18 |
| dhx_m | file_download.php:104 | 13:18 |
| dhx_m | header( 'Content-Disposition:' . $t_disposition . ' filename="' . urlencode( $t_filename ) . '"' ); | 13:18 |
| dhx_m | urlencode is doing that | 13:18 |
| dhx_m | not sure how safe it is to remove, but I imagine that will fix your problem | 13:19 |
| dhx_m | RFC2045 Section 6.4 prohibits anything other than 7bit, 8bit or binary | 13:21 |
| dhx_m | whatever that means | 13:21 |
| [KK]Kirill | one sec | 13:22 |
| [KK]Kirill | I just search site with correect work | 13:22 |
| dhx_m | can you also test with internet explorer (assuming you use Windows)? | 13:25 |
| [KK]Kirill | your attach in IE ????.%E6%B5%B7%E7%B4%8D%E7%99%BE%E5%B7%9D | 13:26 |
| [KK]Kirill | square is ierogliph | 13:26 |
| dhx_m | is this with or without urlencode at file_download.php:104? | 13:26 |
| [KK]Kirill | I don't change yet. one sec | 13:27 |
| dhx_m | ok | 13:27 |
| [KK]Kirill | when I remove urlencode - filename show correct | 13:28 |
| dhx_m | [KK]Kirill: I'm not sure that is correct though, I'm reading some RFCs now to double check | 13:33 |
| nuclear_eclipse | RFC's?! wth type of developer are you? | 13:34 |
| dhx_m | haha | 13:35 |
| nuclear_eclipse | the RFC is the CODE! | 13:35 |
| dhx_m | I'm sure whatever RFC we follow, Internet Explorer doesn't support :p | 13:35 |
| nuclear_eclipse | probably | 13:35 |
| dhx_m | http://greenbytes.de/tech/tc2231/ | 13:38 |
| giallu | nuclear_eclipse, yo | 13:58 |
| nuclear_eclipse | hi giallu | 13:58 |
| giallu | hi | 13:58 |
| nuclear_eclipse | mantisbot died :( | 13:58 |
| giallu | yeah sorry | 13:59 |
| giallu | I restarted the machine yesterday fror a kernel update | 13:59 |
| giallu | and forgot it :) | 13:59 |
| nuclear_eclipse | excuses... | 13:59 |
| dhx_m | not good enough! :p | 13:59 |
| giallu | it's not an excuse, I'm saying it's my fault... | 14:00 |
| giallu | :P | 14:00 |
| nuclear_eclipse | lies! | 14:00 |
| dhx_m | I think what nuclear_eclipse is hinting at is a blood sacrifice | 14:00 |
| nuclear_eclipse | exactly! | 14:00 |
| giallu | nuclear_eclipse, go find a virgin then | 14:00 |
| giallu | let's see bug 4286 | 14:02 |
| mantisbot | Bug 4286 - indy - open - assigned | 14:02 |
| mantisbot | Solution for reporting via E-Mail - http://www.mantisbt.org/bugs/view.php?id=4286 | 14:02 |
| nuclear_eclipse | yay! | 14:02 |
| * nuclear_eclipse hugs mantisbot | 14:02 | |
| dhx_m | that'd be the world's largest Mantis issue? :p | 14:03 |
| giallu | dhx_m, probably | 14:05 |
| dhx_m | [KK]Kirill: ok I might have a patch ready in a moment | 14:11 |
| CIA-16 | Mantisbt: hickseydr * r3b39c3452b8a /file_download.php: Fix #10494: support UTF-8 attachment filenames | 14:20 |
| [KK]Kirill | dhx_m: nice | 14:22 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * r726bf4288326 /core/obsolete.php: Update obsolete.php after rename of $g_reminder_recipents_monitor_bug rename | 14:22 |
| CIA-16 | Mantisbt: hickseydr master-1.2.x * r4807ed6de31e /file_download.php: Fix #10494: support UTF-8 attachment filenames | 14:22 |
| dhx_m | [KK]Kirill: are you able to test on IE? | 14:22 |
| [KK]Kirill | dhx_m: one sec | 14:23 |
| dhx_m | [KK]Kirill: thanks | 14:23 |
| [KK]Kirill | in one file - work | 14:23 |
| [KK]Kirill | but other - not | 14:23 |
| dhx_m | hmm | 14:23 |
| dhx_m | I only tested with random Chinese characters from zh.wikipedia.org | 14:23 |
| dhx_m | with Firefox 3.5 | 14:23 |
| [KK]Kirill | ... | 14:25 |
| [KK]Kirill | http://www.kaliningrad.ru/news/incidents/k870128.html | 14:25 |
| [KK]Kirill | look my street | 14:25 |
| [KK]Kirill | dhx_m: for pict not work | 14:26 |
| dhx_m | [KK]Kirill: ah I see, inline pictures I guess | 14:26 |
| dhx_m | [KK]Kirill: wow...the flooding looks bad! | 14:28 |
| dhx_m | [KK]Kirill: are you talking about trying to save an inline image by right clicking on it and choosing "save image"? | 14:29 |
| [KK]Kirill | and right click on thumb and right click on full image - all such before update | 14:31 |
| [KK]Kirill | but other documents, like Word, Excel - nice work | 14:31 |
| dhx_m | IE7 works too? | 14:31 |
| dhx_m | well I take back "works" and replace that with "fails in a favourable way" :p | 14:32 |
| dhx_m | [KK]Kirill: I suspect it might be a Firefox bug? | 14:40 |
| [KK]Kirill | dhx_m: I use IEView in FF | 14:40 |
| dhx_m | ok | 14:40 |
| dhx_m | does it use the IE download window? | 14:41 |
| [KK]Kirill | dhx_m: picture saved as file_donwload | 14:41 |
| dhx_m | the name was "file_download"? | 14:42 |
| [KK]Kirill | yes | 14:43 |
| dhx_m | ugh that's not good | 14:43 |
| [KK]Kirill | dhx_m: in IE | 14:43 |
| dhx_m | but word documents are OK? | 14:43 |
| [KK]Kirill | that's normal for IE | 14:43 |
| dhx_m | and other binary files? | 14:43 |
| dhx_m | oh.. :) | 14:43 |
| dhx_m | so it must ignore content-disposition? | 14:44 |
| [KK]Kirill | dhx_m: this for save as | 14:45 |
| dhx_m | hmm | 14:49 |
| dhx_m | I'm not sure if this is fixable | 14:49 |
| dhx_m | they seem to treat image file names differently from download file names | 14:49 |
| [KK]Kirill | dhx_m: why pictures name different from other filenames? | 14:52 |
| dhx_m | [KK]Kirill: looks like a bug within the browser? | 14:52 |
| [KK]Kirill | may be. | 14:53 |
| paul_ | dhx_m: isn't that an unspported header in IE? | 14:54 |
| brad__ | hi, sorry for the intrusion, are there any upgrade docs for 1.1.x -> 1.2.x? | 14:54 |
| dhx_m | paul_: yep, which is why it falls back to using the second filename="" | 14:55 |
| dhx_m | paul_: not sure about IE8... | 14:55 |
| [KK]Kirill | dhx_m: I have IE7 | 14:55 |
| dhx_m | [KK]Kirill: IE7 is actually doing it wrong if you don't see urlencoded filenames | 14:56 |
| dhx_m | [KK]Kirill: it doesn't support RFC2231 and therefore shouldn't assume urlencoded filenames are UTF-8 | 14:56 |
| nuclear_eclipse | brad__: not officially -- should be a matter of a) backup your exisitng install/database, b) extract the new files, c) copy over your old config_inc.php and custom_*.php, and d) visit mantisbt/admin/install.php from your browser | 14:57 |
| dhx_m | [KK]Kirill: but I guess in this case it is kind of OK that it it broken... unless you have filenames that actually do contain percentage symbols! | 14:57 |
| brad__ | nuclear_eclipse: thanks. it looks like there were some db changes, i might just try and adjust the schemas manually. | 14:58 |
| nuclear_eclipse | brad__: I highly recommend against that | 14:59 |
| nuclear_eclipse | admin/install.php will handle the schema upgrade for you | 14:59 |
| brad__ | nuclear_eclipse: yeah? swank. | 14:59 |
| nuclear_eclipse | we try :) | 15:00 |
| dhx_m | brad__: backup first! | 15:00 |
| nuclear_eclipse | dhx_m: that would be the "a) backup your exisitng install/database" step :P | 15:01 |
| dhx_m | nuclear_eclipse: yep, just emphasising :p | 15:01 |
| brad__ | what is this "backup" of which you speak? | 15:01 |
| [KK]Kirill | paul_: mantisforge not sync | 15:01 |
| brad__ | worked like a charm, thanks! | 15:05 |
| dhx_m | hmmm explode() isn't UTF-8 safe and I used it for getting file extensions from a file name (and elsewhere) | 15:08 |
| dhx_m | not so good | 15:08 |
| nuclear_eclipse | hmm, afaik, explode is utf-8 safe as long as you are exploding on ascii characters only | 15:09 |
| nuclear_eclipse | eg, exploding a utf-8 string on ',' is safe | 15:09 |
| dhx_m | the problem is that if your delimiter is '.' - that character might be bye 2 within the middle of a 4 byte character | 15:09 |
| nuclear_eclipse | eg, exploding a utf-8 string on russian character is not safe.. | 15:10 |
| dhx_m | so explode() would split the string in the middle of a character | 15:10 |
| dhx_m | AFAIK the only safe character to split/explode on is 0x00 | 15:10 |
| nuclear_eclipse | dhx_m: I was under the impression that UTF-* used byte encodings that could not be interpreted as ASCII-127... | 15:10 |
| nuclear_eclipse | I could be wrong | 15:11 |
| dhx_m | nuclear_eclipse: maybe you're right and the second and subsequent bytes must be non-ASCII-127 | 15:11 |
| dhx_m | I'll check | 15:11 |
| nuclear_eclipse | I mean, I still don't completely understand how Unicode and UTF* encodings work | 15:11 |
| dhx_m | ah you're right :) | 15:11 |
| dhx_m | the first bit in every byte of a multibyte character is always true | 15:12 |
| nuclear_eclipse | holy crap, I actually *knew* something about UTF! | 15:12 |
| dhx_m | and is false when it is a single byte character (ASCII) | 15:12 |
| dhx_m | haha | 15:12 |
| dhx_m | it'd be safe to explode on UTF-8 chars as well I imagine | 15:13 |
| dhx_m | hmmm wait, maybe not | 15:13 |
| dhx_m | no | 15:13 |
| nuclear_eclipse | no, because a UTF-8 char would potentially be multi-byte | 15:15 |
| nuclear_eclipse | and explode only works on a single byte | 15:15 |
| dhx_m | you can have a multi character delimeter for explode | 15:16 |
| dhx_m | the problem is that explode will cut the string mid way through multibyte characters | 15:16 |
| nuclear_eclipse | ah | 15:16 |
| paul_ | correct | 15:16 |
| paul_ | we need to review our use/handling of utf8 properly | 15:17 |
| dhx_m | yep | 15:17 |
| dhx_m | is there even a utf8 version of explode? | 15:17 |
| paul_ | unknown | 15:17 |
| nuclear_eclipse | or we could just continue to use utf8-safe functions everywhere so that it won't matter... | 15:17 |
| paul_ | I plan to compare php6 with unicode + php5 with mbstring/intl/whatever else + php5 without | 15:17 |
| nuclear_eclipse | well, php6 changes everything with native support anyways... | 15:18 |
| dhx_m | Mantis supporting UTF-8 correctly will be a big boost to the project, as most other bug trackers wouldn't know what the U in UTF-8 stands for :p | 15:18 |
| * dhx_m can't wait for PHP6 | 15:19 | |
| paul_ | nuclear_eclipse: the problem is the utf8php functions + the mbstring functions don't give the same result if you put in all utf8 chars | 15:19 |
| paul_ | the obvious proof therefore is to prove if php6 + php5wmbstring give the same result | 15:19 |
| paul_ | and then look at the compat functions | 15:20 |
| paul_ | if they don't give the same result | 15:20 |
| paul_ | the obvious proof is to compare php6 with the compat functions | 15:20 |
| dhx_m | I imagine there will be a TON of bugs in PHP6 relating to Unicode when it is released | 15:20 |
| paul_ | also if it's realised I guess | 15:20 |
| paul_ | i'm trying to get my head around php internals a bit more atm | 15:21 |
| * dhx_m fears the repercussions in the form of "why did you connect an anonymous public member object to a magic class attribute?" :p | 15:24 | |
| dhx_m | or something else I have no idea about hah | 15:24 |
| paul_ | mm? | 15:24 |
| dhx_m | just saying that if you become a PHP expert, you can't go back :p | 15:24 |
| dhx_m | every time to read PHP scripts you'll shudder in fear at the low quality | 15:25 |
| dhx_m | :p | 15:25 |
| * giallu just read the namespace docs from php 5.3 | 15:25 | |
| dhx_m | I tried to read about anonymous somethings in 5.3 but gave up heh | 15:26 |
| giallu | now I think I'll leave php for python | 15:27 |
| dhx_m | the problem is we won't be able to use many of these new PHP features until ~2-3 years after release | 15:28 |
| dhx_m | otherwise we won't be compatible with distro versions of PHP and all the shared web hosts still running PHP4 | 15:28 |
| dhx_m | giallu: how is it performance wise? | 15:31 |
| giallu | dhx_m, 1.2 is not compatible with php4 | 15:31 |
| dhx_m | giallu: yep I know, but if you want to use namespaces from 5.3... how long do we wait? | 15:32 |
| giallu | if you ask me, until the first RHEL releases with it... | 15:32 |
| nuclear_eclipse | IMO, never :P | 15:33 |
| dhx_m | lol | 15:34 |
| dhx_m | ok different topic... did you understand stephane's patch for CSV (bug #9338) | 15:34 |
| mantisbot | Bug 9338 - sveyret - open - acknowledged | 15:34 |
| mantisbot | CSV export does not escape all characters - http://www.mantisbt.org/bugs/view.php?id=9338 | 15:34 |
| dhx_m | was there something wrong with str_replace? | 15:34 |
| nuclear_eclipse | generally, I would always say namespaces are an absolute must, but unless things have changed, PHP's namespacing just seems insane... | 15:34 |
| dhx_m | ah yeah there would be | 15:35 |
| dhx_m | what about exploding the string on quotation marks, prepending a quotation mark to all exploded array elements from 1 to the end | 15:35 |
| dhx_m | and then imploding again into the final string | 15:36 |
| dhx_m | seems simpler than his method of looping through characters in the string and using strpos | 15:36 |
| nuclear_eclipse | I'm not sure I'm grasping what the point of either method is... | 15:36 |
| dhx_m | actually yeah... neither | 15:37 |
| dhx_m | I'm still completely confused at Stephanes patch (even after his latest message)... HELP!? :p | 15:58 |
| paul_ | dhx_m: i'll look tonight | 16:47 |
| dhx_m | paul_: thanks... see if you can work out why we can't just use a single str_replace with arrays :p | 16:55 |
| nuclear_eclipse | dhx_m: two things I've come up against with the session security changes that you've mentioned | 17:47 |
| nuclear_eclipse | the fact that the security hash would no longer change between different views/submissions of a form a) prevents us from using the form security to also handle double-submissions, and b) means that someone eavesdropping on traffic can pick up the token and use it for any number of future CSRF attacks against a specific user/session | 17:50 |
| nuclear_eclipse | honestly, just how big is your session store getting under the existing implementation? | 17:50 |
| * paul_ has missed session changes | 17:51 | |
| nuclear_eclipse | paul_: haven't gotten past concepts/ideas really | 17:52 |
| nuclear_eclipse | dhx_m: even on the server for mantisbt.org, the php session store is only ~6MB... | 17:53 |
| paul_ | we should fix that | 17:53 |
| * nuclear_eclipse is not sure what to "fix" | 17:53 | |
| paul_ | dunno but Ithink it needs fixing | 17:53 |
| nuclear_eclipse | 6MB really isn't that much... | 17:53 |
| nuclear_eclipse | but paul_, we are considering a method that would no longer store more than a single hash in the user's session | 17:54 |
| nuclear_eclipse | but I'm concerned about how much of a security issue that reopens | 17:54 |
| nuclear_eclipse | eg, our current system does not "reuse" hashes, because it can generate and keep track of them in the user's session store | 17:55 |
| dhx_m | back | 17:55 |
| dhx_m | nuclear_eclipse: double posting is a real problem, I agree | 17:56 |
| nuclear_eclipse | but using a stateless security hash means that the same hash would have to be used everytime for each type of form, which increases the vector of possible attack | 17:56 |
| dhx_m | nuclear_eclipse: unless we have two tokens per form... one is for double posting (short timeout) and one for CSRF (timeout = end of session) | 17:56 |
| nuclear_eclipse | granted, it would still be extremely small... | 17:56 |
| dhx_m | nuclear_eclipse: I was also thinking of using base64 for the hashes to reduce space used | 17:57 |
| nuclear_eclipse | dhx_m: that removes the ability for a form submission to happen over a long time span though... | 17:57 |
| dhx_m | nuclear_eclipse: if you had 100 people browsing it'd get noticeable I think | 17:57 |
| nuclear_eclipse | base64 won't give you much | 17:58 |
| dhx_m | nuclear_eclipse: hmmm not too sure about how we handle double posting nicely | 17:58 |
| dhx_m | nuclear_eclipse: I can push my branch to mantisforge if you'd like to test the space used? | 17:58 |
| nuclear_eclipse | I'm not worried about file space | 17:58 |
| dhx_m | nuclear_eclipse: every html button on the bug view page gets a token though | 17:59 |
| dhx_m | nuclear_eclipse: but we have to parse through 1000's of tokens to find the one we're interested in... | 17:59 |
| nuclear_eclipse | like I said, even 6MB for a session store seems rather manageable, considering mantisbt.org gets a very good amount of traffic | 17:59 |
| dhx_m | nuclear_eclipse: true... if it's a hash map it'd be fast | 17:59 |
| dhx_m | nuclear_eclipse: even a 512MB hashmap wouldn't be the end of the world | 18:00 |
| nuclear_eclipse | right | 18:00 |
| nuclear_eclipse | granted, the current method of storage and searching is not the most efficient | 18:00 |
| dhx_m | nuclear_eclipse: (if worst came to worst)... the session files would be cached in memory anyway | 18:00 |
| dhx_m | nuclear_eclipse: yep if we can remove the loops and implement an O(n) lookup I'd be happy (hashmap?) | 18:01 |
| nuclear_eclipse | we could simply improve the current method of storing/searching for security tokens, if it's performance you're worried about... | 18:01 |
| dhx_m | yeah performance is my concern | 18:01 |
| nuclear_eclipse | ok | 18:01 |
| dhx_m | in particular, lots of small disk I/O | 18:01 |
| nuclear_eclipse | yeah | 18:01 |
| dhx_m | ok just pushed branch 10627-csrf to mantisforge | 18:02 |
| nuclear_eclipse | I'll look into a more efficient storage and retrieval, but after pondering and such, I don't like the idea of removing one-time hashes altogether.... | 18:03 |
| dhx_m | that is my WIP in getting CSRF tokens everywhere they need to be | 18:03 |
| nuclear_eclipse | ok | 18:03 |
| nuclear_eclipse | the nice part about the current list storage method is that it makes purging old tokens a trivial addition to the current lookup | 18:04 |
| dhx_m | yep | 18:04 |
| dhx_m | I do very much prefer single use tokens too | 18:04 |
| nuclear_eclipse | maybe a multi-dimensional array would be better: $tokens[ $date ][ $hash ] = true | 18:05 |
| nuclear_eclipse | that would let us easily purge an entire days worth of tokens without iterating through each one | 18:05 |
| dhx_m | nuclear_eclipse: then we have an accuracy of 23hrs59min for the expiry? | 18:05 |
| dhx_m | can we store it per hour? | 18:06 |
| nuclear_eclipse | and it would allow O(n) retrieval too (assuming an efficient hashing algorithm on PHP's end | 18:06 |
| dhx_m | yep | 18:06 |
| nuclear_eclipse | the current accuracy is ~24hrs anyways, specifically to err on the side of allowing slightly older tokens... | 18:06 |
| dhx_m | I guess we're talking about accuracy per-session, so no real big deal :) | 18:07 |
| nuclear_eclipse | right | 18:09 |
| nuclear_eclipse | dhx_m: able to test? | 18:36 |
| nuclear_eclipse | dhx_m: http://git.mantisforge.org/w/mantisbt/jreese.git?a=shortlog;h=refs/heads/formperf | 18:37 |
| dhx_m | sure | 18:39 |
| nuclear_eclipse | initial tests seem to show it as "working", but I would like more validation before I push that to master and/or port to 1.1 and 1.2 | 18:39 |
| nuclear_eclipse | my test box is not good for verifying any performance increase though, as it's got terriblly poor and random I/O performance anyways | 18:41 |
| dhx_m | my main concern at the moment is mt_rand and how it is seeded | 18:41 |
| nuclear_eclipse | mt_rand is seeded automatically by PHP | 18:41 |
| nuclear_eclipse | iirc, that is | 18:42 |
| dhx_m | if anything, that'd be our weak point... but it is more a theoretical thing I guess | 18:42 |
| nuclear_eclipse | oops, we're seeding it in core.php | 18:42 |
| nuclear_eclipse | list( $usec, $sec ) = explode( ' ', microtime() ); | 18:42 |
| nuclear_eclipse | mt_srand( $sec*$usec ); | 18:42 |
| dhx_m | not so random then :p | 18:43 |
| nuclear_eclipse | well, iirc, that's considered the "good" method of seeding it | 18:43 |
| dhx_m | I guess we have to build our own entropy somehow | 18:43 |
| dhx_m | hmm ok | 18:43 |
| nuclear_eclipse | hmm | 18:44 |
| nuclear_eclipse | from PHP: Note: As of PHP 4.2.0, there is no need to seed the random number generator with srand() or mt_srand() as this is now done automatically. | 18:44 |
| dhx_m | I'd rather trust PHP to pull it from a more random place like /dev/random | 18:44 |
| dhx_m | if it can do that | 18:44 |
| nuclear_eclipse | the real question is how does PHP seed it? | 18:45 |
| paul_ | refs/heads/formperf | 18:46 |
| paul_ | ? | 18:46 |
| nuclear_eclipse | yes paul_ | 18:46 |
| paul_ | hmm? | 18:46 |
| paul_ | whats this | 18:46 |
| nuclear_eclipse | a branch.... | 18:46 |
| paul_ | doing? | 18:46 |
| dhx_m | it'll eat you alive | 18:46 |
| nuclear_eclipse | paul_: go back to sleep | 18:46 |
| dhx_m | paul_: improved performance for storing/retrieving single use form tokens | 18:47 |
| paul_ | hmmmm | 18:47 |
| paul_ | sounds dangerous | 18:47 |
| nuclear_eclipse | not really | 18:47 |
| * paul_ makes note to look at this branch | 18:47 | |
| dhx_m | it's cleaner than it was before :) | 18:48 |
| dhx_m | paul_: also see refs/heads/10627-csrf | 18:49 |
| dhx_m | paul_: still WIP, but it is my progress towards making Mantis bulletproof to CSRF :p | 18:50 |
| * nuclear_eclipse updated the branch to also remove the mt_srand() call, because PHP seeds with a better algorithm | 18:50 | |
| paul_ | right | 20:17 |
| * paul_ pokes dhx_m | 20:17 | |
| phl4kx | hi all | 21:39 |
| phl4kx | mantis cand Send email when and informated or developer update and IMAGE? | 21:40 |
Generated by irclog2html.py