396563 - "urlbase" parameter generates an absolute URL for the login form on index.cgi

Status: RESOLVED DUPLICATE of bug 329638

(Bugzilla :: Administration, task)

Description

[Anthony]

User-Agent:       Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Build Identifier: version 3.0.1

Setting urlbase has the effect of setting absolute url's in Bugzilla's pages.

The problem with this is that if you want to set up an environment accessible from two different networks (eg. intranet/internet), or you want to access bugzilla via a reverse proxy, those absolute url's present a problem. The "Log In" link poses a particular difficulty.

Why does Bugzilla not use relative links?
Is there an effective workaround to this problem?

Reproducible: Always

Steps to Reproduce:
1.
2.
3.



If urlbase is left empty, relative url's are generated which is in this case the desired effect. A slight problem here is of course that correct links are not sent in user emails.

Comment 1

[Frédéric Buclin]

See bug 325079 for the details.

Comment 2

[Max Kanat-Alexander]

It would be nice to find another way to fix this, though. People complain about this fairly frequently.

Comment 3

[Anthony]

So as I understand it, the "Log In" url is absolute for security reasons.

Perhaps you could add an option to use absolute or relative paths in general, with a warning that the latter case may be insecure.

Another way to solve this riddle with Apache would be to use an html output filter inside a virtual host block, changing the internal address to an external one on the way out. I found one called mod_proxy_html (http://apache.webthing.com/mod_proxy_html/).

Comment 4

[Frédéric Buclin]

I really don't want a param for that.

Comment 5

[lohphat]

I just came across this when we were about to deploy another instance on port :7070

When you go to bugzilla:7070 the "Log In" URL at the top ignores the port specifier, however once logged in, all URLs are $HOST:$PORT relative.

What's funny is that when you log out, the "Log In Again" in the middle of the page is correctly formed with the port number but the top "Log In" URL is still missing it.

Comment 6

[Frédéric Buclin]

Same root cause as bug 329638.