930013 - fall back to the bug's current delta_ts when validating a token if one is not provided to process_bug.cgi

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[:glob ✱]

tl;dr bug 927736 broken bzapi in an unexpected way.


bzapi updates bugs by posting to process_bug.cgi.  current consumers just pass in an update token.  bug 927736 changes the token verification to also rely on the delta_ts which is provided by our forms, but not by bzapi.

while process_bug.cgi isn't a supported api, we should do what we can to not cause undue pain to bzapi.


a compromise would be to validate the token against the bug's current delta_ts if one is not provided by the form.  all our forms will continue to work correctly in all circumstances, while bzapi will work in cases where a mid-air has not occurred.

Comment 1

[:glob ✱]

Attachment: 930013_1.patch

Comment 2

[David Lawrence [:dkl]]

Comment on attachment 821007 [details] [diff] [review]
930013_1.patch

Review of attachment 821007 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 3

[:glob ✱]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified process_bug.cgi
Committed revision 8786.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.4/
modified process_bug.cgi
Committed revision 8631.