1922411 - Bugzilla relies on multi-part set-cookie for LASTORDER which is disabled in newer Firefox

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[Sam James]

See bug 1903210 where I originally reported this as a Firefox bug.

Reproduce steps:
Go to https://bugs.gentoo.org/ or https://gcc.gnu.org/bugzilla
Click the "Bugs changed in the last 24 hours" link (https://bugs.gentoo.org/buglist.cgi?chfieldfrom=24h or https://gcc.gnu.org/bugzilla/buglist.cgi?chfieldfrom=24h)
Click "Modified" on the rightmost column to sort by recently-modified bugs first
Click "Home" on the top menubar (to return to the Bugzilla instance homepage)
Click the "Bugs changed" link from 2. again
Observe the modified order being wrong

The 'LASTORDER' cookie doesn't get saved.

This turns out to be because FF recently disabled the feature that this type of cookie relies on, see https://bugzilla.mozilla.org/show_bug.cgi?id=1903210#c8.

Comment 1

[Dave Miller [:justdave]]

Removing server push in upstream Bugzilla is bug 1238084, which is currently marked as security-sensitive because of a use case that may or may not have been resolved in upstream CGI.pm years ago. I'm attempting to figure out if that upstream issue has been dealt with, and if so, I'll clear the flag.

In any case, we need to expedite it if Firefox nuked the cookie handling from this feature.

Bugzilla 5.9.1 and up (development branch) have this gone already, because it picked up the fix from BMO. We should backport this to 5.2 though (and maybe 5.0.4.1 given the drastic nature of the effect of the change to Firefox)

Comment 2

[Dave Miller [:justdave]]

I just said in comment 1 that this didn't affect harmony and 4 minutes later I set it as a release blocker for harmony. lol. I just verified from looking at the code that this indeed does not affect harmony, so I'm removing from the harmony blocker list.

Comment 3

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] [5.0.4] Bug 1922411: Remove server-push from buglist.cgi (#217)

Comment 4

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] [5.2] Bug 1922411: Remove server-push from buglist.cgi (#218)

Comment 5

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] [5.3] Bug 1922411: Remove server-push from buglist.cgi (#219)

Comment 7

[Dave Miller [:justdave]]

Taking this on 5.3 branch since Bugzilla will break in Firefox once they land their removal of the feature.

Comment 8

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] Bug 1922411: Remove dead server-push infrastructure (#226)

Comment 9

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] Bug 1922411: Remove dead server-push infrastructure (#227)

Comment 10

[Frédéric Buclin]

Comment on attachment 9600162 [details] [review]
[bugzilla/bugzilla] [5.0.4] Bug 1922411: Remove server-push from buglist.cgi (#217)

r=LpSolit for 5.0.4, together with #227. Would be easier to have them in the same patch.

Comment 11

[Frédéric Buclin]

Comment on attachment 9600441 [details] [review]
[bugzilla/bugzilla] Bug 1922411: Remove dead server-push infrastructure (#227)

r=LpSolit combined with the other patch

Comment 12

[Dave Miller [:justdave]]

Comment on attachment 9600221 [details] [review]
[bugzilla/bugzilla] Bug 1922411: Remove dead server-push infrastructure (#226)

This PR got merged into #218 prior to landing

Comment 13

[Dave Miller [:justdave]]

Comment on attachment 9600441 [details] [review]
[bugzilla/bugzilla] Bug 1922411: Remove dead server-push infrastructure (#227)

This PR got merged into #217 before landing.

Comment 14

[Dave Miller [:justdave]]

Comment on attachment 9600162 [details] [review]
[bugzilla/bugzilla] [5.0.4] Bug 1922411: Remove server-push from buglist.cgi (#217)

https://github.com/bugzilla/bugzilla/commit/cb4b4bc7b3e2e2e484ac2f66d48e2e8430ccf7cf

Comment 15

[Dave Miller [:justdave]]

Comment on attachment 9600163 [details] [review]
[bugzilla/bugzilla] [5.2] Bug 1922411: Remove server-push from buglist.cgi (#218)

https://github.com/bugzilla/bugzilla/commit/79d36ed16e65f7cbbb0f542f5fd6eacbe8cc4153

Comment 16

[Dave Miller [:justdave]]

Comment on attachment 9600164 [details] [review]
[bugzilla/bugzilla] [5.3] Bug 1922411: Remove server-push from buglist.cgi (#219)

https://github.com/bugzilla/bugzilla/commit/832c348ecbca6894c85e623d4a14fcaa3d367603