| ../irclogs/#mantishelp.2010-08-03.log | ||
| --- scribe started --- | 00:00 | |
| davidinc | Who is responsible for preparing and arranging the docbook for mantisbt???? | 06:39 |
|---|---|---|
| davidinc | hi | 06:39 |
| davidinc | nuclear_eclipse: Hi | 07:28 |
| thefake | hi there, i've a question about the roadmap, specially versions: Hot to remove the release date "Scheduled For Release" like the Mantis Project did at it's own installation, do i really have to edit the source by my own? | 07:49 |
| thefake | found it in an old ticket :) $g_show_roadmap_dates = OFF; | 07:56 |
| thefake | thx for | 07:56 |
| thefake | audience ;) | 07:56 |
| samtuke | hi, as I recall there used to be a feature allowing documents to be added to a mantis install, allowing users to view them. I can't see this link or configuration option in 1.2.1, has it been depreciated, or how do I use it? I'm referring to the old 'project documentation' | 10:08 |
| samtuke | has this been moved to a plugin? | 10:10 |
| dhx_m | it's still built in | 10:15 |
| dhx_m | but it doesn't get used much by MantisBT users so it could be buggy/non-functional at the moment | 10:16 |
| dhx_m | it's a prime candidate for being cut out into a separate plugin | 10:16 |
| dhx_m | see config_defaults_inc.php for settings that control this feature on/off, etc | 10:16 |
| samtuke | hmm, why was it removed, seems like a simple and useful feature? | 10:16 |
| samtuke | thanks, ive found it there | 10:18 |
| dhx_m | it's not removed | 10:18 |
| samtuke | ill re-enable it and see what happens | 10:18 |
| dhx_m | yep | 10:18 |
| samtuke | OK, I mean, why was it disabled and not maintained | 10:18 |
| dhx_m | it's disabled by default like a lot of MantisBT features | 10:18 |
| dhx_m | and it's "not maintained" in the sense that few people (especially developers) seem to use the feature | 10:19 |
| samtuke | OK, thanks for the info :) | 10:24 |
| nuclear_eclipse | davidinc: hi | 11:34 |
| davidinc | nuclear_eclipse: hi | 11:34 |
| nuclear_eclipse | I wrote almost everything in the developer guide, but the admin guide is more or less a conversion of the old 1.0.x and 1.1.x manuals, and nobody is officially in charge of maintaining them... =\ | 11:35 |
| davidinc | ok | 11:40 |
| dhx_m | I heard there is an opening for "Official MantisBT Documentation Maintainer" with davidinc's name written all over it :p | 11:44 |
| nuclear_eclipse | lol | 11:44 |
| * nuclear_eclipse shakes davidinc's hand | 11:44 | |
| dhx_m | ... by force? :p | 11:45 |
| davidinc | no pro | 11:45 |
| davidinc | cool | 11:45 |
| nuclear_eclipse | dammit man, think of the *children*! | 11:45 |
| nuclear_eclipse | just imagine all those classrooms full of innocent kids, crying because our manual is out of date... *you* can change that... | 11:46 |
| davidinc | *YOU* mean dhx_m | 11:47 |
| dhx_m | lol | 11:48 |
| davidinc | lol | 11:48 |
| nuclear_eclipse | it was an all-inclusive "you"; I don't care who it is as long as it isn't me.. ;) | 11:48 |
| LFH_SPA | Hello | 12:07 |
| LFH_SPA | I am new in the mantis world | 12:07 |
| LFH_SPA | and I am facing some problems when i try to install it with SQL server | 12:08 |
| LFH_SPA | I am getting the folliwing error: Database query failed. Error received from database was #206: Conflicto de tipos de operandos: int es incompatible con text for the query: INSERT INTO mantis_config_table | 12:08 |
| LFH_SPA | I had applied the patchs especified in http://www.mantisbt.org/bugs/view.php?id=10742 | 12:09 |
| LFH_SPA | but they didn´t help | 12:09 |
| LFH_SPA | the ecosystem is: Win XP, PHP 5.2, SQL Server 2005, Mantis 1.2.2 | 12:11 |
| paulr | dhx_m: yours :P | 12:11 |
| dhx_m | paulr: yours :P get the Moodle DB layer working already :p | 12:12 |
| dhx_m | LFH_SPA: we have known issues with database upgrades when using MS SQL (perhaps other database types too) due to inconsistencies between database server SQL implementations | 12:14 |
| paulr | dhx_m: ahh I was gonna ask you about that | 12:14 |
| dhx_m | LFH_SPA: I suggest upgrading to 1.2.0, then 1.2.1 then 1.2.2 (don't skip versions)? | 12:14 |
| paulr | dhx_m: if we write our own layer based on the moodle code, it wouldn't be GPL right? | 12:14 |
| dhx_m | LFH_SPA: AFAIK I broke things in 1.2.1 by dropping some of our custom ADOdb hacks (hence why paulr palmed off this issue to me!)... I am ideally trying to get those patches accepted upstream where they belong | 12:15 |
| dhx_m | paulr: I suspect not... depending on just how much it is based | 12:16 |
| paulr | do we need to support db2? | 12:17 |
| dhx_m | do any developers use it? if not, then no... as no one will have any interest in maintaining that support | 12:18 |
| dhx_m | if a DB2 user wants to help maintain DB2 support then they can always add that support later | 12:18 |
| dhx_m | IMO anyway ;) | 12:18 |
| LFH_SPA | I am not upgradding | 12:19 |
| LFH_SPA | it´s a brand new installation | 12:19 |
| dhx_m | brand new database? :o | 12:20 |
| LFH_SPA | DHX_M: What should I do? Install teh 1.2.0 version? | 12:20 |
| dhx_m | probably, yes | 12:20 |
| dhx_m | then upgrade 1.2.0 to 1.2.2 | 12:20 |
| dhx_m | at least until we fix things up | 12:20 |
| LFH_SPA | ok | 12:20 |
| LFH_SPA | thanks for your help | 12:20 |
| LFH_SPA | I will do it and let you know | 12:21 |
| dhx_m | no problem, let me know how you go | 12:21 |
| LFH_SPA | by the way | 12:22 |
| LFH_SPA | where is the 1.2.0 version available | 12:22 |
| dhx_m | sourceforge should have it | 12:23 |
| LFH_SPA | I took a look and the 1.2.2 is the only stable one available | 12:23 |
| LFH_SPA | ok | 12:23 |
| LFH_SPA | ok | 12:24 |
| LFH_SPA | thanks | 12:24 |
| LFH_SPA | bye | 12:24 |
| dhx_m | sounds like you have to go urgently? cya | 12:25 |
| nkj | hi everyone | 13:22 |
| nkj | i just setup v1.2.2 on my server | 13:22 |
| nkj | however, i'm having trouble getting any new accounts created. | 13:22 |
| nkj | everytime i get the new account link (to set the password for the first time) after filling out the form I get the error #2800 | 13:23 |
| nkj | "Invalid form security token. Did you submit the form twice by accident?" | 13:23 |
| nkj | which I didn't | 13:23 |
| nkj | same thing happens when I try to submit the 'lost password' form, i enter my username and email address, and click submit - and get the error #2800 | 13:24 |
| nkj | seems to be happening with any form submission at all | 13:25 |
| nkj | i don't see any errors in the apache log files | 13:26 |
| nkj | does anyone have any ideas as to what this might be? | 13:26 |
| nkj | searching on google has come up with no relevant, up to date, info on the problem | 13:27 |
| nkj | apparently people have had similar issues, but nothing related to simply trying to activate an account in the first place. | 13:27 |
| nkj | and most issues i found on google were reported & fixed/resolved on the 1.1.x branch up to 2 years ago. | 13:28 |
| nkj | which makes me think this has got to be a configuration issue, just not sure where to start looking. | 13:28 |
| nkj | as I'm not sure how mantisBT decides that error #2800 is what it should display | 13:29 |
| nkj | i could reverse engineer it, but my time is very limited and so I thought I'd ask for help/advice/tips/clues here first. | 13:30 |
| nuclear_eclipse | nkj: is there a proxy server between your machine and the mantis server? | 13:33 |
| nkj | nuclear_eclipse: the server is on the rackspace cloud, but i dont think there is any proxying going on | 13:34 |
| nuclear_eclipse | nkj: ah, it sounds like the server's aren't correctly sharing your session data | 13:35 |
| nkj | nuclear_eclipse: i had the default ubuntu package installed first (1.1.8 i believe) but removed it and installed 1.2.2 from tarball. | 13:35 |
| nkj | the ubuntu package seemed to work fine. | 13:36 |
| nkj | nuclear_eclipse: so far, it's just running on one server | 13:36 |
| nuclear_eclipse | oh | 13:36 |
| nkj | the dev server is solo | 13:36 |
| nuclear_eclipse | well, you can disable form security protection, but do note that it opens a potential attack vector against administrators: http://en.wikipedia.org/wiki/Cross-site_request_forgery | 13:37 |
| nuclear_eclipse | ubuntu may have disabled it by default, or maybe they are using a patched version of 1.1.x of some sort | 13:37 |
| nkj | nuclear_eclipse: that exploit is only possible from an already trusted user, correct? | 13:39 |
| nuclear_eclipse | no | 13:39 |
| nkj | from someone with no account at all? | 13:39 |
| nkj | ah | 13:39 |
| nkj | i think i get it | 13:40 |
| nkj | hmm, well - i will have the site protected behind http auth as well | 13:40 |
| nkj | so i think it should be ok | 13:40 |
| nuclear_eclipse | a malicious person could post an <img> tag on a site that points to some form on your site, and anyone already logged into your site that views that <img> tag could unknowingly submit forms, like creating a new user, etc | 13:40 |
| nkj | right - hijacking the session cookie | 13:40 |
| nuclear_eclipse | nkj: the attack has to be specifically targetted against your site, so private sites at least are obscure enough to have a low chance of attack, but it's still possible | 13:41 |
| nkj | nuclear_eclipse: how do I disable the security protection> | 13:41 |
| nkj | is it g_session_validation? | 13:42 |
| nuclear_eclipse | the main cause for problems with that protection is proxy servers (or even reverse proxy servers) that incorrectly cache pages and serve old versions with stale or invalid CSRF tokens | 13:42 |
| nuclear_eclipse | no | 13:42 |
| nuclear_eclipse | $g_form_security_validation = ON; | 13:42 |
| nkj | ok | 13:43 |
| nkj | nuclear_eclipse: thanks, i'll give it a shot now | 13:44 |
| nuclear_eclipse | I'd imagine that rackspace cloud probably has a reverse proxy in front of their servers that's either ignoring the caching headers we send or something of the sort | 13:44 |
| nkj | thats very possible, this is my first time using them so i don't know how their systems are setup | 13:49 |
| nkj | nuclear_eclipse: that solved the problem, thanks - however now I've got a problem actually setting the new users password | 14:25 |
| nkj | when I enter the desired password, click submit, i don't get the error, it then redirects to the main login page... when I test the username/password i get the incorrect login error message | 14:26 |
| nkj | "Your account may be disabled or blocked or the username/password you entered is incorrect." | 14:26 |
| nkj | checking in the DB, it looks like the password field for the user was not updated. | 14:26 |
| nuclear_eclipse | hate to say it, but it sounds like whatever underlying issue that caused the form security errors might be causing the same problem with the actual form submissions... =\ | 14:27 |
| nkj | hmmm | 14:28 |
| nuclear_eclipse | nkj: is php properly configured to store session data? | 14:28 |
| nkj | nuclear_eclipse: which setting in the php ini is required? | 14:30 |
| nuclear_eclipse | nkj: the entire [session] block (session.*) should looked over and configured to match your setup | 14:32 |
| nuclear_eclipse | specifically, session.save_path needs to point somewhere that the webserver account has write access to | 14:32 |
| nuclear_eclipse | and session.use_cookies must be enabled | 14:32 |
| nuclear_eclipse | depending on the situation, you may also need to update mantis' configuration options for cookies too | 14:33 |
| nkj | ok i'll give it a look over | 14:37 |
| istvanb | Hi there | 15:55 |
| istvanb | The question I have: is there any company deals with Mantis support officially? | 15:56 |
| nuclear_eclipse | istvanb: not that I know of | 15:57 |
| istvanb | hmm | 15:58 |
| istvanb | our IT has this concern that what if we have issues, how can we fix without support | 15:58 |
| nuclear_eclipse | istvanb: you can always request help from a mailing list, or you can find the problem and fix it yourself since it's open source... | 15:59 |
| istvanb | oh yeah, I completely agree with you. In the other hand I understand the concerns of the IT as well, since if we have a major problem it would be nice to have a phone number where we can ask for help (and pay for them as well:) | 16:00 |
| nuclear_eclipse | istvanb: this is the best I can offer: http://www.mantisbt.org/consulting.php | 16:02 |
| istvanb | I have dropped a mail there 2 weeks ago when I went for vacation, but recieved no response :( | 16:02 |
| nuclear_eclipse | istvanb: I'm not sure where that mail goes to, so I unfortunately can't help you there | 16:03 |
| istvanb | :) | 16:04 |
| istvanb | its ok | 16:04 |
| istvanb | I am not really concerned about this, however for sure it would be great to have something like that! | 16:05 |
| nuclear_eclipse | yeah, I agree | 16:05 |
| paulr | istvanb: you can pay me for support | 16:16 |
| paulr | if anything breaks | 16:17 |
| paulr | i'll hit nuclear_eclipse on irc until he fixes it | 16:17 |
| nuclear_eclipse | paulr: good luck, I already have a busy enough life... :P | 16:17 |
| istvanb | haha :) | 16:19 |
| istvanb | funny mate :) | 16:19 |
| istvanb | my plan is to introduce Mantis, screw it then quit and make a support company :) | 16:19 |
| istvanb | now I gotta go, but ttys guys | 16:20 |
| mantisbt_46530 | hi | 17:08 |
| Shakra | dhx_z: are you around today? | 19:36 |
| Shakra | I may have found another bug in bug_update.php. | 19:37 |
| paulr | he's sleeping | 20:02 |
| paulr | :) | 20:02 |
| Shakra | ok no problem :) do you know when he's normally up and about? | 20:15 |
| nuclear_eclipse | Shakra: he lives in Australia :P | 20:53 |
| paulr | he said he wont be in tomorrow | 21:18 |
| paulr | so probably in 30 hours from now | 21:19 |
| killefiz | giallu: is there a reason (except lack of time) why you haven't updated mantis in fedora to 1.2.x yet? | 22:26 |
| nuclear_eclipse | tsk tsk giallu, falling behind! | 22:28 |
| giallu | killefiz, well. IIRC 1.2.0 was not that good and 1.2.1 had his share of issues as well (but yes, I also lacked time) ;) | 22:33 |
| giallu | now we have CVE-2010-2802 | 22:34 |
| nuclear_eclipse | giallu: it's called bleeding edge for a reason ;0 | 22:34 |
| giallu | nuclear_eclipse, well, no, 1.2.0 was supposed to be stable | 22:34 |
| giallu | master is bleeding edge... | 22:34 |
| nuclear_eclipse | tis a joke buddy | 22:35 |
| giallu | oh sorry ;) | 22:35 |
| nuclear_eclipse | if we had kept 1.2.0 in the wings any longer it would have been born with grey hair and a wheelchair | 22:35 |
| giallu | anyway john, I don't also like to push 1.2 on older Fedora releases because of the manual steps involved | 22:36 |
| nuclear_eclipse | oh, I understand | 22:36 |
| giallu | but, I'd probably bite the bullet if we haven't a fix for the CVE | 22:36 |
| nuclear_eclipse | packaging is difficult with all the restrictions distros put in place... | 22:36 |
| nuclear_eclipse | giallu: btw, how the hell do CVE's get created/reported? | 22:36 |
| giallu | not sure, I just get notified by Red Hat/Fedora security team | 22:37 |
| giallu | nuclear_eclipse, do you have a point for the commit fixing the issue? | 22:37 |
| giallu | pointer even | 22:37 |
| nuclear_eclipse | hmm, sec | 22:38 |
| nuclear_eclipse | giallu: it's related to bug 11952 | 22:38 |
| foobot | Bug 11952 - dhx - fixed - closed | 22:38 |
| foobot | Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks - http://www.mantisbt.org/bugs/view.php?id=11952 | 22:38 |
| nuclear_eclipse | giallu: http://git.mantisbt.org/?p=mantisbt.git;a=commitdiff;h=618f45ac57a45854fa96bcfd79f9f44dcdfcfab3 | 22:39 |
| giallu | anyway: http://seclists.org/oss-sec/2010/q3/136 | 22:39 |
| giallu | let's see, isn't fileinfo based detection only in 1.2.x? | 22:40 |
| nuclear_eclipse | I dunno, ask dhx :P | 22:41 |
| giallu | asking google instead... | 22:41 |
| nuclear_eclipse | he said he apparently got a request from Red Hat to backport the issue to 1.1.x, so my guess is that it affects that too | 22:42 |
| giallu | uhm, I'm pretty sure FileInfo based detection was added later | 22:44 |
| giallu | and google agrees with me. now I'd need an 1.2.1 instance to test | 22:45 |
| nuclear_eclipse | giallu: you can use my tracker at http://leetcode.net/mantis if you'd like... | 22:46 |
| nuclear_eclipse | I haven't gotten around to pulling the latest from git | 22:46 |
| killefiz | giallu: ok - let me know if you need any help with the update | 22:47 |
| killefiz | I guess at least rawhide and probably f14 should be moved to 1.2.2 | 22:48 |
| giallu | killefiz, ok, I also prepared a semi decent spec with unbundled libs, but the transition to git is slowing me down a bit (need to learn the new workflow) | 22:48 |
| killefiz | i haven't pushed any update with git yet either but it looks like being able to merge between releases is going to be a huge timesaver in the future | 22:50 |
| nuclear_eclipse | giallu: that actually looks really nifty | 22:51 |
| nuclear_eclipse | gitolite is also pretty nifty | 22:51 |
| nuclear_eclipse | tempted to try and set that up on our git server at work | 22:51 |
| giallu | http://git.mantisbt.org/?p=mantisbt.git;a=commit;h=d85822de161fcede76fa54ce1f8081135387e8a5 | 22:54 |
| giallu | killefiz, well. I was always trying to keep branches in sync by copying the spec file. not sure if it will be faster | 22:56 |
| giallu | anyway | 22:56 |
| paulr | nuclear_eclipse: gitolite ? | 23:05 |
| giallu | nuclear_eclipse, you don't enable showing of uploaded images right? | 23:13 |
| paulr | giallu | 23:20 |
| paulr | <nuclear_eclipse> he said he apparently got a request from Red Hat to backport the issue to 1.1.x, so my guess is that it affects that too | 23:20 |
| paulr | do we still support 1.1? | 23:20 |
| giallu | irrelevant | 23:20 |
| giallu | at least in this context | 23:20 |
| paulr | mm, ok | 23:20 |
| giallu | but I did not hear anything on the topic from other mantis devs | 23:21 |
| giallu | traditionally we stopped support of older stable releases | 23:21 |
| giallu | albeit with git it should be a bit easier to backport selected stuff | 23:21 |
| paulr | pretty sure dhx (as opposed to nuclear_eclipse) has said he'd like to move to a different version numbering scheme | 23:21 |
| paulr | even with git | 23:22 |
| paulr | historically there's been so much churn in source, you've got no chance :) | 23:22 |
| giallu | I'm not opposed to changes, just tell him to throw the proposal on the dev-list for those who can't be here all the time ;) | 23:23 |
| nuclear_eclipse | paulr: gitolite is a repo/acl management system for git that supposedly allows you to have fine grained ACL setups similar to what you get with SVN | 23:23 |
| nuclear_eclipse | Fedora has adopted it for their package development workflow | 23:24 |
| giallu | anyone with a IE handy? | 23:24 |
| paulr | giallu: I think in principle, it was along lines of just use year.month for release or whatever | 23:24 |
| * paulr has IE | 23:24 | |
| paulr | nuclear_eclipse: ahh | 23:24 |
| giallu | paulr, can you click on the attachment here: http://leetcode.net/mantis/view.php?id=170 | 23:25 |
| nuclear_eclipse | paulr: I've told debian/ubuntu people that we'd at least support major security issues in 1.1.x | 23:25 |
| nuclear_eclipse | I also told them we might not make a full release of it, but we'd at least accept patches into our repo | 23:25 |
| giallu | paulr, what happens with IE there? | 23:26 |
| paulr | it offers me a file download of a 48byte file | 23:26 |
| * paulr loads fiddler | 23:27 | |
| paulr | i'll just give you the headers | 23:27 |
| nuclear_eclipse | giallu: if you need me to modify config somehow, let me know | 23:27 |
| paulr | X-Content-Type-Options: nosniff | 23:28 |
| paulr | Content-Disposition: filename="html_in_disguise.gif" | 23:28 |
| nuclear_eclipse | I think it's pretty much default configs for the most part | 23:28 |
| paulr | that's got the x-content header in | 23:28 |
| giallu | uhm | 23:28 |
| giallu | nuclear_eclipse, did you upgrade the tracker to 1.2.2? | 23:28 |
| giallu | I'm not sure what I should be looking at right now... | 23:29 |
| nuclear_eclipse | ohh.. | 23:30 |
| nuclear_eclipse | I forgot just how long that patch has been around... | 23:30 |
| nuclear_eclipse | lemme checkout 1.2.1 for the site real quick | 23:30 |
| paulr | http://bugs.mantisforge.org/file_download.php?file_id=1&type=bug | 23:30 |
| nuclear_eclipse | ok, it's at 1.2.1 now | 23:31 |
| paulr | Content-Type: image/gif | 23:31 |
| paulr | Content-Disposition: filename="html_in_disguise.gif" | 23:31 |
| paulr | IE just displays the text for me | 23:31 |
| paulr | no javascript alert | 23:31 |
| paulr | maybe you need <html> etc at top of file | 23:32 |
| nuclear_eclipse | paulr: it's only when you view the img inline in the page | 23:32 |
| nuclear_eclipse | going through file_download.php can't trigger it | 23:32 |
| paulr | http://bugs.mantisforge.org/view.php?id=1 | 23:33 |
| paulr | isn't that what that does? | 23:33 |
| paulr | img alt="" style="border: 0; max-height:250px;" src="file_download.php?file_id=1&type=bug" />< | 23:34 |
| paulr | although that might be older then dhx's initial changes | 23:34 |
| nuclear_eclipse | try again on my tracker, I checked out release-1.2.1 on it | 23:35 |
| paulr | url | 23:36 |
| nuclear_eclipse | http://leetcode.net/mantis/view.php?id=170 | 23:36 |
| paulr | not getting a popup | 23:36 |
| paulr | ahh | 23:36 |
| paulr | do when i go to download the file | 23:36 |
| paulr | so i'd be inclined to think | 23:36 |
| paulr | that dhx broke it | 23:37 |
| paulr | then fixed | 23:37 |
| paulr | so it might be ok prior to 1.2.1 | 23:37 |
| paulr | or prior to 1.2.0 | 23:37 |
| paulr | can you checkout 1.2.0 onto it? | 23:37 |
| giallu | nuclear_eclipse, paulr thanks for checking | 23:37 |
| nuclear_eclipse | does it only happen to IE? | 23:37 |
| nuclear_eclipse | or will Chrome repro it too? | 23:37 |
| giallu | nuclear_eclipse, yeah FF looks ok | 23:37 |
| giallu | dunno, I've chrome only on windows | 23:38 |
| giallu | will check tomorrow | 23:38 |
| giallu | now I need some sleep... | 23:38 |
| giallu | bye | 23:38 |
| nuclear_eclipse | because if I can reproduce it, I can use git-bisect to figure out exactly where it "broke" | 23:38 |
| nuclear_eclipse | cya giallu | 23:38 |
| giallu | nuclear_eclipse, have a look at the commit I linked before | 23:38 |
| paulr | nuclear_eclipse: I can probably tell you that ;p | 23:39 |
| nuclear_eclipse | giallu: that was a merge commit? | 23:39 |
| giallu | september 8, 2009 | 23:39 |
| giallu | yeah merge a finfo branch | 23:39 |
| nuclear_eclipse | oh, that's when that feature first went in? | 23:39 |
| giallu | guess so | 23:40 |
| giallu | try a checkout of the previous commit | 23:40 |
| nuclear_eclipse | it's checked out on my tracker now | 23:41 |
| paulr | think I need sleep too | 23:41 |
| nuclear_eclipse | I just got the JS popup on that, but didn't with 1.2.1 checked out | 23:42 |
| nuclear_eclipse | giallu: ping me tomorrow and I'll help you work this all out | 23:42 |
Generated by irclog2html.py