207044 - Filter more template directives

Status: RESOLVED FIXED

(Bugzilla :: User Interface, defect, P2)

Description

[Gervase Markham [:gerv]]

You may remember when we introduced the template filtering test, there were a
load of directives which fell into the "it would be good to filter this, but
it's not a security hole" category. They are marked with a "#" character in
filterexceptions.pl.

We didn't filter them first time round to cut down on the testing burden, but
they still need doing. This bug tracks that.

Comment 1

[Gervase Markham [:gerv]]

Attachment: Patch v.1

Firstly, this patch filters all of the marked directives in
filterexceptions.pl, and removes them from that file.

Secondly, I've added a new "none" filter, and made it so that you are not
allowed to have unfiltered directives in either error file. The rule is: if in
doubt, 'html' filter, unless it's imperative that the variable not be changed,
in which case use the 'none' filter. Comments explain this policy.

Also, currently localisation is guaranteed to break filterexceptions.pl,
because we have directives like [% foo ? "Bar" : "Baz" %]. I've altered those
to an IF ELSE form, so that it's much more likely that a localiser can just use
this file as-is to check their work.

Gerv

Comment 2

[Gervase Markham [:gerv]]

Comment on attachment 124164 [details] [diff] [review]
Patch v.1

This patch is likely to rot very quickly, yet is pretty easy to review, so I'm
hoping we can move quickly on this one.

Gerv

Comment 3

[Gervase Markham [:gerv]]

Attachment: Patch v.2

Fix a few typos etc.

Gerv

Comment 4

[Gervase Markham [:gerv]]

Comment on attachment 124166 [details] [diff] [review]
Patch v.2

This patch is rapidly rotting... someone review it, please! :-)

Gerv

Comment 5

[Bradley Baetz (:bbaetz)]

Comment on attachment 124166 [details] [diff] [review]
Patch v.2

The first messages.html.tmpl hunk doens't apply, but its easy to do manually.

>Index: template/en/default/reports/duplicates-table.html.tmpl

>@@ -76,8 +76,8 @@
>                 [% "&maxrows=$maxrows" IF maxrows %]
>                 [% "&changedsince=$changedsince" IF changedsince %]
>                 [% "&openonly=1" IF openonly %]
>-                [% "&product=$product" IF product %]
>-                [% "&format=$format" IF format %]
>+                [% IF product %]&product=[% product FILTER html %][% END %]
>+                [% IF format %]&format=[% format FILTER html %][% END %]

You could do this w/o the IF/END, couldn't you?

>Index: template/en/default/reports/report-table.csv.tmpl

>@@ -27,10 +27,14 @@
> [% row_field_disp = field_descs.$row_field || row_field %]
> 
> [% title = BLOCK %]
>-  [% "$tbl_field_disp: $tbl\n" IF tbl_field %]
>-  [% row_field_disp IF row_field %]
>+  [% IF tbl_field %]
>+    [% tbl_field_disp FILTER csv %]: [% "$tbl\n" FILTER csv %]
>+  [% END %]

Won't the CSV filter wrap the \n in quotes too?

>Index: template/en/default/list/table.html.tmpl

>@@ -136,8 +137,9 @@
>     [% tableheader %]
>   [% END %]
> 
>-  <tr class="bz_[% bug.bug_severity %] bz_[% bug.priority %] [%+ "bz_secure" IF bug.isingroups %]">
>-
>+  <tr class="bz_[% bug.bug_severity FILTER html %] 
>+             bz_[% bug.priority FILTER html %] 
>+             [%+ "bz_secure" IF bug.isingroups %]">

These need to be CSS filtered to be any use. I don't think html entities are
valid in css class names, and even if they were, there are other characters to
be escaped.

>Index: template/en/default/bug/dependency-tree.html.tmpl

>@@ -45,7 +51,13 @@
> [% END %]
> 
> [%# Display the tree of bugs that this bug blocks. %]
>-<h3>[% hide_resolved ? "Open b" : "B" %]ugs that <a href="show_bug.cgi?id=[% bugid %]">bug [% bugid %]</a> blocks</h3>
>+<h3>
>+  [% IF hide_resolved %]
>+    Open bugs
>+  [% ELSE %]
>+    Bugs
>+  [% END %] 
>+  that <a href="show_bug.cgi?id=[% bugid %]">bug [% bugid %]</a> blocks</h3>

Why do you need this? Whats wrong with ?: ?

> [% IF blocked_ids.size > 0 %]
>   (
>   [% IF maxdepth -%]Up to [% maxdepth %] level[% "s" IF maxdepth > 1 %] deep | [% END %]
>@@ -108,7 +120,8 @@
>        <input name="maxdepth" type="hidden" value="[% maxdepth %]">
>      [% END %]
>      <input type="hidden" name="hide_resolved" value="[% hide_resolved ? 0 : 1 %]">
>-     <input type="submit" value="[% hide_resolved ? "Show" : "Hide" %] Resolved">
>+     <input type="submit" 
>+            value="[% IF hide_resolved %]Show[% ELSE %]Hide[% END %] Resolved">
>    </form>
>    </td>
> 

And here, too - ?: makes even more sense. And for hte rest of this file.
>Index: template/en/default/bug/votes/list-for-user.html.tmpl

>@@ -19,9 +19,9 @@
>   # Contributor(s): Gervase Markham <[e-mail]>
>   #%]
> 
>+[% h2 = voting_user.login FILTER html %]
> [% PROCESS global/header.html.tmpl
>            title = "Show Votes"
>-           h2 = voting_user.name
>  %]

Here you've changed from their login to their name. The user may not have a
realname; you can't do that.

>Index: template/en/default/attachment/list.html.tmpl
>===================================================================
>RCS file: /cvsroot/mozilla/webtools/bugzilla/template/en/default/attachment/list.html.tmpl,v
>retrieving revision 1.8
>diff -u -r1.8 list.html.tmpl
>--- template/en/default/attachment/list.html.tmpl	27 Nov 2002 16:00:37 -0000	1.8
>+++ template/en/default/attachment/list.html.tmpl	25 May 2003 12:34:25 -0000
>@@ -57,13 +57,13 @@
>           [% IF attachment.flags.size == 0 %]
>             <i>none</i>
>           [% ELSE %]
>-            [% FOR flag = attachment.flags %]
>+            [% FOREACH flag = attachment.flags %]
>                 [% IF flag.setter %]
>                   [% flag.setter.nick FILTER html %]:
>                 [% END %]
>                 [%+ flag.type.name %][% flag.status %]

flag.type.name needs filtering too. As well as going through the # marked
stuff, alsto go through the original bug where a ocuple of places whch needed
the #'ing were mntioned. This was one of them.

>Index: template/en/default/account/prefs/account.html.tmpl

>@@ -74,7 +74,7 @@
>         </tr>
>         <tr>
>           <th align="right">Change request expires:</th>
>-          <td>[% login_change_date %]</td>
>+          <td>[% login_change_date FILTER html %]</td>

Why does the date need html filtering? (And don't we hav a datetime filter
anyway?) Ditto for the next hunk.

Comment 6

[Gervase Markham [:gerv]]

Attachment: Patch v.3

>>-		   [% "&product=$product" IF product %]
>>-		   [% "&format=$format" IF format %]
>>+		   [% IF product %]&product=[% product FILTER html %][% END %]
>>+		   [% IF format %]&format=[% format FILTER html %][% END %]
> 
> You could do this w/o the IF/END, couldn't you?

You could, but it bloats the URL, which makes it nastier for
copying/pasting/sending around. A small point, I know. Also, keeping the IF is
consistent with what went before.

>>Index: template/en/default/list/table.html.tmpl
>>-  <tr class="bz_[% bug.bug_severity %] bz_[% bug.priority %] [%+ "bz_secure"
IF bug.isingroups %]">
>>-
>>+  <tr class="bz_[% bug.bug_severity FILTER html %] 
>>+		bz_[% bug.priority FILTER html %] 
>>+		[%+ "bz_secure" IF bug.isingroups %]">
> 
> These need to be CSS filtered to be any use. I don't think html entities are
> valid in css class names, and even if they were, there are other characters
to
> be escaped.

Well, surely the HTML entities will be unescaped before passing to the CSS
engine? We are in HTML here, and not CSS. Also, what is "CSS filtering"? Is it
like JS?

>>Index: template/en/default/bug/dependency-tree.html.tmpl
>>-<h3>[% hide_resolved ? "Open b" : "B" %]ugs that <a href="show_bug.cgi?id=[%
bugid %]">bug [% bugid %]</a> blocks</h3>
>>+<h3>
>>+  [% IF hide_resolved %]
>>+    Open bugs
>>+  [% ELSE %]
>>+    Bugs
>>+  [% END %] 
>>+  that <a href="show_bug.cgi?id=[% bugid %]">bug [% bugid %]</a> blocks</h3>

> 
> Why do you need this? Whats wrong with ?: ?

Because it produces really complicated entries in filterexceptions.pl (see the
current version of it for examples), which are hard to read, understand and
maintain, and also because it means localisers have to localise inside
directives, which is something that's best avoided IMO.

>>Index: template/en/default/bug/votes/list-for-user.html.tmpl
>>+[% h2 = voting_user.login FILTER html %]
>> [% PROCESS global/header.html.tmpl
>>	      title = "Show Votes"
>>-	      h2 = voting_user.name
>>  %]
> 
> Here you've changed from their login to their name. The user may not have a
> realname; you can't do that.

Er, no - I've changed from name to login :-)

Other stuff fixed. Re-review? :-)

Gerv

Comment 7

[Bradley Baetz (:bbaetz)]

Comment on attachment 125387 [details] [diff] [review]
Patch v.3

> Well, surely the HTML entities will be unescaped before passing to the CSS
> engine? We are in HTML here, and not CSS. Also, what is "CSS filtering"? Is it
> like JS?

Sure, but consider a resolution of "WORKS FOR ME". That then becomes
|class="bz_WORKS FOR ME"| - ie three classes. Its perfectly valid HTML, and
even valid CSS, but its not doing what you want. You need |class="bz_WORKS\
FOR\ ME"|. There are other characters, too. You used to have to escape _, but
that got changed in a css2 errata. Not sure what other characters. \, I guess.
. and # and * as well, I presume, although we probably have issues with # as a
name already due to other escaping & confusion with anchor refs.

Comment 8

[Bradley Baetz (:bbaetz)]

After talking to Hixie on IRC, its only space we care about. the \ escaping
happens in the css file, not in html. Just .replace it as %20 - don't bother
with a filter, esp since its not really a css filter, and the 'what is valid'
test will be different depending on context

Comment 9

[Gervase Markham [:gerv]]

Drat. This has really rotted. :-( I'll have to re-create it. <sigh>

Gerv

Comment 10

[Bradley Baetz (:bbaetz)]

Comment on attachment 125387 [details] [diff] [review]
Patch v.3

Yeah, its rotted.

Comment 11

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 124166 [details] [diff] [review]
Patch v.2

Removing unuseful review requests.

Comment 12

[Gervase Markham [:gerv]]

Dave: do you want me to have another go at this for 2.17.5? I'm willing to, but
only if you can guarantee it'll get a review this time :-)

Gerv

Comment 13

[Dave Miller [:justdave]]

go for it.  I did some of it in the spammer bug, filtering emails and so forth.
 We should get these in.

Comment 14

[Gervase Markham [:gerv]]

I won't have time to do this until Monday night - 1st September. If we need it
before then, someone else feel free to take it on. It's a fairly mechanical
process. The hard part is always choosing the right filter; see my previous
patch if you are unsure.

Gerv

Comment 15

[Gervase Markham [:gerv]]

Attachment: Patch v.4

I unexpectedly found some time this evening, so here is the patch again. Doing
this is really tedious, and I'd rather not do it a third time, so if someone
could please review it, I'd be very grateful :-)

Gerv

Comment 16

[Tobias Burnus]

+#   where the filter is one of html|csv|js|url_quote|quoteUrls|time|uri|xml|none
How about "css_class_quote"?

Comment 17

[Gervase Markham [:gerv]]

tobias: separate bug :-)

Gerv

Comment 18

[Dave Miller [:justdave]]

Comment on attachment 130568 [details] [diff] [review]
Patch v.4

> Index: template/en/default/reports/duplicates-table.html.tmpl
> ===================================================================
> @@ -78,8 +78,8 @@
>                  [% "&maxrows=$maxrows" IF maxrows %]
>                  [% "&changedsince=$changedsince" IF changedsince %]
>                  [% "&openonly=1" IF openonly %]
> -                [% "&product=$product" IF product %]
> -                [% "&format=$format" IF format %]
> +                [% IF product %]&product=[% product FILTER html %][% END %]
> +                [% IF format %]&format=[% format FILTER html %][% END %]
>                  [% "&bug_id=$bug_ids_string&sortvisible=1" IF sortvisible %]">

Shouldn't these & all be & and/or FILTER html on them?

> Index: template/en/default/reports/report-table.csv.tmpl
> ===================================================================
> -[% title FILTER csv %],
> +[% title %],

Why are you removing the filter here?

> Index: template/en/default/list/list.html.tmpl
> ===================================================================
> @@ -148,7 +148,8 @@
> -      <a href="mailto:[% bugowners %]">Send Mail to [% terms.Bug %] Owners</a> &nbsp;&nbsp;
> +      <a href="mailto:[% bugowners FILTER html %]">Send Mail to Bug Owners</a> 
> +      &nbsp;&nbsp;

Why are you removing terms.Bug here?

> Index: template/en/default/global/user-error.html.tmpl
> ===================================================================
> @@ -246,7 +256,7 @@
>           
>    [% ELSIF error == "illegal_change" %]
>      [% title = "Not allowed" %]
> -    You tried to change the <strong>[% field %]</strong> field 
> +    You tried to change the <strong>[% field FILTER html %]</strong> field 
>      from <em>[% oldvalue FILTER html %]</em> to 
>      <em>[% newvalue FILTER html %]</em>, 
>      but only the owner or submitter of the [% terms.bug %], or a 

Probably outside of the scope of this bug (should we file a new one or just do
it since we're touching this line anyway...?)

That really ought to be [% field_descs.$field FILTER html %]

> Index: template/en/default/bug/dependency-tree.html.tmpl
> ===================================================================
> @@ -32,8 +32,14 @@
>  [% PROCESS depthControlToolbar %]
>  
>  [%# Display the tree of bugs that this bug depends on. %]
> -<h3>[% hide_resolved ? "Open $terms.bugs" : "$terms.Bugs" %]
> - that <a href="show_bug.cgi?id=[% bugid %]">[% terms.bug %]&nbsp;[% bugid %]</a> depends on</h3>
> +<h3>
> +  [% IF hide_resolved %]
> +    Open [% terms.bugs %]
> +  [% ELSE %]
> +    [% terms.Bugs %]
> +  [% END %] 
> +  that <a href="show_bug.cgi?id=[% bugid %]">[% terms.bug %]&nbsp;[% bugid %]</a> 
> +  depends on</h3>
>  [% IF dependson_ids.size > 0 %]
>    (
>    [% IF maxdepth -%]Up to [% maxdepth %] level[% "s" IF maxdepth > 1 %] deep | [% END %]

You seem to be doing "FILTER html" on bug_id in many other places, how come you
aren't here?

> @@ -112,7 +124,9 @@
>         <input name="maxdepth" type="hidden" value="[% maxdepth %]">
>       [% END %]
>       <input type="hidden" name="hide_resolved" value="[% hide_resolved ? 0 : 1 %]">
> -     <input type="submit" value="[% hide_resolved ? "Show" : "Hide" %] Resolved">
> +     <input type="submit" 
> +            value="[% IF hide_resolved %]Show[% ELSE %]Hide[% END %] Resolved">
> +Resolved">
>     </form>
>     </td>

You have |Resolved">| here twice.

OK, that's it for this go-through....  this is really close :)

Comment 19

[Gervase Markham [:gerv]]

>>                  [% "&maxrows=$maxrows" IF maxrows %]
>>                  [% "&changedsince=$changedsince" IF changedsince %]
>>                  [% "&openonly=1" IF openonly %]
>> -                [% "&product=$product" IF product %]
>> -                [% "&format=$format" IF format %]
>> +                [% IF product %]&product=[% product FILTER html %][% END %]
>> +                [% IF format %]&format=[% format FILTER html %][% END %]
>>                  [% "&bug_id=$bug_ids_string&sortvisible=1" IF sortvisible %]">
> 
> Shouldn't these & all be & and/or FILTER html on them?

The others don't need filtering. They could be &, yes.

>> -[% title FILTER csv %],
>> +[% title %],
> 
> Why are you removing the filter here?

Because the title is instead filtered further up, I seem to remember.

> You seem to be doing "FILTER html" on bug_id in many other places, how come you
> aren't here?

"Many other places" is actually the error* templates, where everything has to be
filtered. I don't think we do it anywhere else...

I'll fix this up tonight.

Gerv

Comment 20

[Gervase Markham [:gerv]]

Attachment: Patch v.5

With Dave's suggested changes. 

Gerv

Comment 21

[Dave Miller [:justdave]]

Comment on attachment 130860 [details] [diff] [review]
Patch v.5

r= justdave

Comment 22

[Dave Miller [:justdave]]

woohoo

Comment 23

[Gervase Markham [:gerv]]

Fixed.

Checking in template/en/default/filterexceptions.pl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/filterexceptions.pl,v 
<--  filterexceptions.pl
new revision: 1.9; previous revision: 1.8
done
Checking in template/en/default/search/form.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/search/form.html.tmpl,v 
<--  form.html.tmpl
new revision: 1.19; previous revision: 1.18
done
Checking in template/en/default/search/knob.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/search/knob.html.tmpl,v 
<--  knob.html.tmpl
new revision: 1.12; previous revision: 1.11
done
Checking in template/en/default/search/search-report-graph.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/search/search-report-graph.html.tmpl,v
 <--  search-report-graph.html.tmpl
new revision: 1.5; previous revision: 1.4
done
Checking in template/en/default/search/search-report-table.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/search/search-report-table.html.tmpl,v
 <--  search-report-table.html.tmpl
new revision: 1.6; previous revision: 1.5
done
Checking in template/en/default/reports/components.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/reports/components.html.tmpl,v
 <--  components.html.tmpl
new revision: 1.7; previous revision: 1.6
done
Checking in template/en/default/reports/duplicates-simple.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/reports/duplicates-simple.html.tmpl,v
 <--  duplicates-simple.html.tmpl
new revision: 1.3; previous revision: 1.2
done
Checking in template/en/default/reports/duplicates-table.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/reports/duplicates-table.html.tmpl,v
 <--  duplicates-table.html.tmpl
new revision: 1.8; previous revision: 1.7
done
Checking in template/en/default/reports/report-table.csv.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/reports/report-table.csv.tmpl,v
 <--  report-table.csv.tmpl
new revision: 1.5; previous revision: 1.4
done
Checking in template/en/default/reports/report-table.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/reports/report-table.html.tmpl,v
 <--  report-table.html.tmpl
new revision: 1.8; previous revision: 1.7
done
Checking in template/en/default/reports/report.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/reports/report.html.tmpl,v
 <--  report.html.tmpl
new revision: 1.7; previous revision: 1.6
done
Checking in template/en/default/list/change-columns.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/change-columns.html.tmpl,v
 <--  change-columns.html.tmpl
new revision: 1.11; previous revision: 1.10
done
Checking in template/en/default/list/list.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/list.html.tmpl,v 
<--  list.html.tmpl
new revision: 1.14; previous revision: 1.13
done
Checking in template/en/default/global/code-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/code-error.html.tmpl,v
 <--  code-error.html.tmpl
new revision: 1.30; previous revision: 1.29
done
Checking in template/en/default/global/messages.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/messages.html.tmpl,v
 <--  messages.html.tmpl
new revision: 1.14; previous revision: 1.13
done
Checking in template/en/default/global/select-menu.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/select-menu.html.tmpl,v
 <--  select-menu.html.tmpl
new revision: 1.3; previous revision: 1.2
done
Checking in template/en/default/global/useful-links.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/useful-links.html.tmpl,v
 <--  useful-links.html.tmpl
new revision: 1.19; previous revision: 1.18
done
Checking in template/en/default/global/user-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl,v
 <--  user-error.html.tmpl
new revision: 1.39; previous revision: 1.38
done
Checking in template/en/default/global/confirm-user-match.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/confirm-user-match.html.tmpl,v
 <--  confirm-user-match.html.tmpl
new revision: 1.6; previous revision: 1.5
done
Checking in template/en/default/bug/show-multiple.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/show-multiple.html.tmpl,v
 <--  show-multiple.html.tmpl
new revision: 1.13; previous revision: 1.12
done
Checking in template/en/default/bug/dependency-tree.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/dependency-tree.html.tmpl,v
 <--  dependency-tree.html.tmpl
new revision: 1.8; previous revision: 1.7
done
Checking in template/en/default/bug/votes/list-for-user.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/votes/list-for-user.html.tmpl,v
 <--  list-for-user.html.tmpl
new revision: 1.10; previous revision: 1.9
done
Checking in template/en/default/bug/process/verify-new-product.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/process/verify-new-product.html.tmpl,v
 <--  verify-new-product.html.tmpl
new revision: 1.11; previous revision: 1.10
done
Checking in template/en/default/bug/process/bugmail.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/process/bugmail.html.tmpl,v
 <--  bugmail.html.tmpl
new revision: 1.3; previous revision: 1.2
done
Checking in template/en/default/bug/create/create.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/create/create.html.tmpl,v
 <--  create.html.tmpl
new revision: 1.20; previous revision: 1.19
done
Checking in template/en/default/bug/create/create-guided.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/create/create-guided.html.tmpl,v
 <--  create-guided.html.tmpl
new revision: 1.12; previous revision: 1.11
done
Checking in template/en/default/bug/activity/table.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/activity/table.html.tmpl,v
 <--  table.html.tmpl
new revision: 1.5; previous revision: 1.4
done
Checking in template/en/default/attachment/list.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/attachment/list.html.tmpl,v
 <--  list.html.tmpl
new revision: 1.14; previous revision: 1.13
done
Checking in template/en/default/admin/flag-type/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/confirm-delete.html.tmpl,v
 <--  confirm-delete.html.tmpl
new revision: 1.4; previous revision: 1.3
done
Checking in template/en/default/admin/flag-type/edit.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/edit.html.tmpl,v
 <--  edit.html.tmpl
new revision: 1.5; previous revision: 1.4
done
Checking in template/en/default/admin/flag-type/list.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/list.html.tmpl,v
 <--  list.html.tmpl
new revision: 1.6; previous revision: 1.5
done
Checking in template/en/default/account/prefs/account.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/account/prefs/account.html.tmpl,v
 <--  account.html.tmpl
new revision: 1.3; previous revision: 1.2
done
Checking in template/en/default/account/prefs/email.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/account/prefs/email.html.tmpl,v
 <--  email.html.tmpl
new revision: 1.10; previous revision: 1.9
done
Checking in Bugzilla/Template.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Template.pm,v  <--  Template.pm
new revision: 1.10; previous revision: 1.9
done
Checking in t/004template.t;
/cvsroot/mozilla/webtools/bugzilla/t/004template.t,v  <--  004template.t
new revision: 1.27; previous revision: 1.26
done
Checking in t/008filter.t;
/cvsroot/mozilla/webtools/bugzilla/t/008filter.t,v  <--  008filter.t
new revision: 1.7; previous revision: 1.6
done
Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.248; previous revision: 1.247
done

Gerv