1183227 - Comment tagging doesn't work if Test::Taint is not installed

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[Michel Forget]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.132 Safari/537.36

Steps to reproduce:

1.  Upgraded from 4.4.4 to 5.0 via tarball (downloaded today, 2015-07-13).
2.  Created a bug.
3.  Created some comments.
4.  Clicked the "tag" link for a comment, and entered one ("spam").
5.  The tag appears in the comment.  It also appears in the list of tags shown to the right of the comments.
6.  Clicked "Save Changes".  


Actual results:

The refreshed page does not show the tags.


Expected results:

I would have expected the tags to save, or some sort of error.  Neither happened.  Everything else about the installation works fine, and other changes to bugs save just fine (like adding new comments) or changing the summary.

I am an admin, and the permissions page of the preferences display shows that I am in the editbugs group, which is the group listed as being used in the "comment_taggers_group" parameter.

If there is anything I can do to help resolve this issue, or diagnose it, please let me know.  I'm very interested in using this feature (it is why I upgraded, in fact).

Comment 1

[u430950]

Comment tags are saved with the enter key immediately rather than the 'Save Changes' button, as comment are not a change that usually requires an email to be sent out.

Comment 2

[Michel Forget]

Attachment: example.png

An example showing tags before save, and gone after.

Comment 3

[Michel Forget]

(In reply to Ryan Wilson [:f1sh] from comment #1)
> Comment tags are saved with the enter key immediately rather than the 'Save
> Changes' button, as comment are not a change that usually requires an email
> to be sent out.

Ok, but they aren't saving when I press enter. And no errors appear.  I've attached a screenshot showing that I've successfully added a comment tag ("spam") but when the page reloads it is gone.

Comment 4

[Michel Forget]

Attachment: show_bug_cgi.png

One thing to note.  The show_bug.cgi I see is somewhat different from the one this site is using.  I don't have a "Preview" button visible.  The attached screenshot shows what I see.

I took a look at the show_bug.cgi file in the bugzilla folder and it is 3905 bytes, dated July 6.

Comment 5

[Frédéric Buclin]

Which browser do you use? Can you reproduce the problem with Firefox, Internet Explorer 11 or Google Chrome?

I ask because your UI is not correct, and so I suspect that's an issue with your browser, not with Bugzilla.

Comment 6

[Michel Forget]

I use Google Chrome.

I was able to reproduce the issue with Internet Explorer 11.

I haven't done anything custom with regard to Bugzilla; no custom CSS, or anything like that.

All I did in order to upgrade from 4.4.4 to the current version was extract the new tarball, copy over the lib folder and data folder was specified by the upgrade instructions, then run checksetup.pl a bunch of times to get the appropriate perl modules, update the database, etc.

My installation is about as vanilla as it could be.

Not sure if this helps, but here is the output of my last run of checksetup.pl:

* This is Bugzilla 5.0 on perl 5.10.1
* Running on Linux 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013

Checking perl modules...
Checking for               CGI.pm (v3.51)     ok: found v3.65 
Checking for           Digest-SHA (any)       ok: found v5.47 
Checking for             TimeDate (v2.23)     ok: found v2.24 
Checking for             DateTime (v0.75)     ok: found v1.20 
Checking for    DateTime-TimeZone (v1.64)     ok: found v1.92 
Checking for                  DBI (v1.54)     ok: found v1.631 
Checking for     Template-Toolkit (v2.24)     ok: found v2.25 
Checking for         Email-Sender (v1.300011) ok: found v1.300018 
Checking for           Email-MIME (v1.904)    ok: found v1.926 
Checking for                  URI (v1.55)     ok: found v1.60 
Checking for       List-MoreUtils (v0.32)     ok: found v0.33 
Checking for    Math-Random-ISAAC (v1.0.1)    ok: found v1.004 
Checking for           File-Slurp (v9999.13)  ok: found v9999.13 
Checking for              JSON-XS (v2.01)     ok: found v3.01 

Checking available perl DBD modules...
Checking for               DBD-Pg (v2.7.0)    ok: found v3.1.1 
Checking for            DBD-mysql (v4.001)    ok: found v4.013 
Checking for           DBD-SQLite (v1.29)     found v1.27 
Checking for           DBD-Oracle (v1.19)     not found 

The following Perl modules are optional:
Checking for                   GD (v1.20)     ok: found v2.44 
Checking for                Chart (v2.4.1)    ok: found v2.4.6 
Checking for          Template-GD (any)       ok: found v1.56 
Checking for           GDTextUtil (any)       ok: found v0.86 
Checking for              GDGraph (any)       ok: found v1.44 
Checking for           MIME-tools (v5.406)    ok: found v5.427 
Checking for          libwww-perl (any)       ok: found v5.833 
Checking for             XML-Twig (any)       ok: found v3.34 
Checking for          PatchReader (v0.9.6)    ok: found v0.9.6 
Checking for            perl-ldap (any)       ok: found v0.40 
Checking for          Authen-SASL (any)       ok: found v2.13 
Checking for         Net-SMTP-SSL (v1.01)     ok: found v1.01 
Checking for           RadiusPerl (any)       ok: found v0.24 
Checking for            SOAP-Lite (v0.712)    ok: found v1.11 
Checking for          XMLRPC-Lite (v0.712)    ok: found v0.717 
Checking for             JSON-RPC (any)       ok: found v1.03 
Checking for           Test-Taint (v1.06)     found v1.04 
Checking for          HTML-Parser (v3.40)     ok: found v3.64 
Checking for        HTML-Scrubber (any)       not found 
Checking for               Encode (v2.21)     ok: found v2.35 
Checking for        Encode-Detect (any)       ok: found v1.01 
Checking for          Email-Reply (any)       ok: found v1.203 
Checking for HTML-FormatText-WithLinks (v0.13)     ok: found v0.14 
Checking for          TheSchwartz (v1.07)     ok: found v1.10 
Checking for       Daemon-Generic (any)       ok: found v0.84 
Checking for             mod_perl (v1.999022) ok: found v2.000004 
Checking for     Apache-SizeLimit (v0.96)     not found 
Checking for        File-MimeInfo (any)       not found 
Checking for           IO-stringy (any)       ok: found v2.110 
Checking for      Cache-Memcached (any)       ok: found v1.28 
Checking for  File-Copy-Recursive (any)       ok: found v0.38 
Checking for              mod_env (any)       ok 
Checking for          mod_expires (any)       ok 
Checking for          mod_headers (any)       ok 
Checking for          mod_rewrite (any)       ok 
Checking for          mod_version (any)       ok 
***********************************************************************
* OPTIONAL MODULES                                                    *
***********************************************************************
* Certain Perl modules are not required by Bugzilla, but by           *
* installing the latest version you gain access to additional         *
* features.                                                           *
*                                                                     *
* The optional modules you do not have installed are listed below,    *
* with the name of the feature they enable. Below that table are the  *
* commands to install each module.                                    *
***********************************************************************
*      MODULE NAME * ENABLES FEATURE(S)                               *
***********************************************************************
*       Test-Taint * JSON-RPC Interface, XML-RPC Interface, REST Interface *
*    HTML-Scrubber * More HTML in Product/Group Descriptions          *
* Apache-SizeLimit * mod_perl                                         *
*    File-MimeInfo * Sniff MIME type of attachments                   *
***********************************************************************
COMMANDS TO INSTALL OPTIONAL MODULES:

     Test-Taint: /usr/bin/perl install-module.pl Test::Taint
  HTML-Scrubber: /usr/bin/perl install-module.pl HTML::Scrubber
Apache-SizeLimit: /usr/bin/perl install-module.pl Apache2::SizeLimit
  File-MimeInfo: /usr/bin/perl install-module.pl File::MimeInfo::Magic


To attempt an automatic install of every required and optional module
with one command, do:

  /usr/bin/perl install-module.pl --all

Reading ./localconfig...

OPTIONAL NOTE: If you want to be able to use the 'difference between two
patches' feature of Bugzilla (which requires the PatchReader Perl module
as well), you should install patchutils from:

    http://cyberelk.net/tim/software/patchutils/

Checking for               DBD-Pg (v2.7.0)    ok: found v3.1.1 
Checking for           PostgreSQL (v8.03.0000) ok: found v09.03.0300 
Checking for               DBD-Pg (v2.19.3)   ok: found v3.1.1 

Removing existing compiled templates...
Precompiling templates...done.
Fixing file permissions...
checksetup.pl complete.

Comment 7

[Frédéric Buclin]

Hum, could you run

  ./install-module.pl Test::Taint

and try again? Your version of this module is too old.

Comment 8

[Michel Forget]

Interesting news!  I think I've found the problem.

The checksetup.pl output lists the following OPTIONAL modules:

*       Test-Taint * JSON-RPC Interface, XML-RPC Interface, REST Interface *
*    HTML-Scrubber * More HTML in Product/Group Descriptions          *
* Apache-SizeLimit * mod_perl                                         *
*    File-MimeInfo * Sniff MIME type of attachments         

I installed Test-Taint and HTML-Scrubber and File-MimeInfo and then ran checksetup.pl again.

Now when I visit a bug, I see the preview window that was misisng and I was able to add a tag and see it persist through a reload of the bug.

I'm guessing one of those 3 (probably test-taint or html-scrubber) isn't really OPTIONAL (at least if you want tags to work).

Comment 9

[Michel Forget]

Hi Frédéric,

I actually just posted a comment saying I did that and it resolved the problem, so that is good news.

The checksetup.pl doesn't complain about the version I had, though, so maybe the prerequisites are wrong.  I would have expected it to complain bitterly if the required version wasn't present like it does about the other modules.

Comment 10

[Frédéric Buclin]

(In reply to Michel Forget from comment #9)
> The checksetup.pl doesn't complain about the version I had

It did. It didn't print "ok" in front of the version, and the line was in red. HTML::Scrubber and File::MimeInfo are unrelated to the problem.

As comment tagging requires JSON-RPC, checks should be added in 5.0 to disable this feature entirely if JSON-RPC is not available. For 6.0, I suggest that JSON-RPC/REST becomes mandatory.

Comment 11

[Frédéric Buclin]

Attachment: patch, v1

Comment 12

[Gervase Markham [:gerv]]

LpSolit: why is a testing module required for _any_ of these features? I assumed it was only required for, well, testing them...

Gerv

Comment 13

[Frédéric Buclin]

(In reply to Gervase Markham [:gerv] from comment #12)
> LpSolit: why is a testing module required for _any_ of these features? I
> assumed it was only required for, well, testing them...

... because there is "Test::" in its name? :) Test::Taint is used to check tainting of data and so is used by several features.

Comment 14

[Gervase Markham [:gerv]]

Comment on attachment 8633513 [details] [diff] [review]
patch, v1

Review of attachment 8633513 [details] [diff] [review]:
-----------------------------------------------------------------

r=gerv.

I agree we need to stop having the API as optional.

Gerv

Comment 15

[Frédéric Buclin]

To ssh://[e-mail]/bugzilla/bugzilla.git
   684bee4..ffe87c7  master -> master

To ssh://[e-mail]/bugzilla/bugzilla.git
   6f616e1..568c933  5.0 -> 5.0