1128853 - Bugzilla shouldn't try to write API tokens into the shadow DB

Status: RESOLVED FIXED

(Bugzilla :: WebService, defect, P1)

Description

[:glob ✱]

if you have a shadow_db, perform a search, and bugzilla needs to create an api_token, the following error is generated:

The MySQL server is running with the --read-only option so it cannot execute this statement [for Statement "INSERT INTO tokens (userid, issuedate, token, tokentype, eventdata) VALUES (?, NOW(), ?, ?, ?)"] (Bugzilla/Token.pm:457)



the decision to include an api token is imho sub-optimal:

> [% IF javascript_urls.containsany(['js/bug.js', 'js/field.js', 'js/comment-tagging.js']) %]
>   , api_token: '[% get_api_token FILTER js FILTER html %]'
> [% END %]

the means we're generating tokens in situations where we don't need one, and doesn't allow for extension page which need to make api calls to use the api_token unless they include one of those three javascript files.

i think it would be better for a boolean to be passed to the header which triggers inclusion of the api_token, and explicitly include the token only where required.

Comment 1

[Frédéric Buclin]

Also, Bugzilla::Token::_create_token() should probably automatically shift to dbh_main before generating the token.

Comment 2

[:glob ✱]

Attachment: 1128853_1.patch

- automatically switch to the shadow db when creating a token
- adds "generate_api_token" param to global/header
- sets generate_api_token to 1 where required
  - most of these are due to user auto-completion
  - no longer generating a token on search results

Comment 3

[David Lawrence [:dkl]]

Comment on attachment 8561219 [details] [diff] [review]
1128853_1.patch

Review of attachment 8561219 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 4

[:glob ✱]

To ssh://[e-mail]/bugzilla/bugzilla.git
   f6686ca..b7147b7  master -> master

To ssh://[e-mail]/bugzilla/bugzilla.git
   dbc7a21..c1fa559  5.0 -> 5.0

Comment 5

[Frédéric Buclin]

Do not forget to a+ your patch too. ;)