487769 - checksetup.pl can no longer create versions in TestProduct due to insufficient privileges (checksetup.pl fails)

Status: RESOLVED FIXED

(Bugzilla :: Installation & Upgrading, defect)

Description

[Frédéric Buclin]

With the checkin of bug 471871, we now make sure that the user has enough privs to create and edit versions for the given product. But checksetup.pl runs code as an "anonymous" user with no privs, and so Bugzilla::Version->check() refuses to create a new version in TestProduct. This makes all fresh new installations to abort.

Comment 1

[Max Kanat-Alexander]

I think we should create a magical user who is always in all groups who can always do things, and set_user as that user when we have to. Of course, we have to be careful if we do that, not to introduce security issues anywhere. But in places like checksetup.pl it should be OK. This would also give us an "account" to show up in places like profiles_activity, and who we could use when checksetup.pl has to write comments and things like that.

Comment 2

[Frédéric Buclin]

(In reply to comment #0)
> as an "anonymous" user with no privs, and so Bugzilla::Version->check() refuses

I meant Bugzilla::Version->create().

Comment 3

[Frédéric Buclin]

Could we create a fake super-user on the fly? I.e. which would only exists in checksetup.pl but not in the DB? All we need is to pass a user object to set_user(), no need to make it exists for real.

Comment 4

[Frédéric Buclin]

Attachment: patch, v1

A user with all privs will automatically be allowed to edit all products. I kill this fake account as soon as TestProduct is fully created.

Comment 5

[Max Kanat-Alexander]

Comment on attachment 372031 [details] [diff] [review]
patch, v1

This is HEAD, so I'd like to do this a little more elegantly.

Also, at some point this user will need an ID and so on too, to be recorded in places like bugs_activity and profiles_activity.

We could possibly name it [e-mail]? Of course, that's a problem if they've renamed terms.Bugzilla. I guess it doesn't need a name for now, so we don't have to worry about it.

Let's create a Bugzilla->super_user or Bugzilla::User->super_user method instead of hacking this in. (And let's not call bless directly.)

Also, I don't think there would be any harm in directly calling Bugzilla->set_user just once in checksetup.pl after the Bugzilla module is loaded, and just having all of checksetup run as that user.

Comment 6

[Frédéric Buclin]

(In reply to comment #5)
> (From update of attachment 372031 [details] [diff] [review])
> This is HEAD, so I'd like to do this a little more elegantly.

My solution is very elegant. :)


> Also, at some point this user will need an ID and so on too, to be recorded in
> places like bugs_activity and profiles_activity.

But for now, this is not necessary, and we would need extra checks to forbid the deletion of this super-user and forbid to remove him from some groups. Also, this user account should be disabled and not getting bugmail. Isn't that a bit too much when the goal here is to fix Install.pm so that Tinderbox stops burning and those using CVS HEAD can again install a fresh copy?

Comment 7

[Max Kanat-Alexander]

(In reply to comment #6)
Like I said:

>  I guess it doesn't need a name for now, so we don't have to worry about it.

Comment 8

[Frédéric Buclin]

It needs a login name, else Bugzilla::User->create will reject it.

Comment 9

[Max Kanat-Alexander]

Attachment: v2

Okay, here is what I was thinking. I also re-wrote that bit of the install stuff to use create() stuff instead, which required a few changes elsewhere.

Comment 10

[Frédéric Buclin]

Comment on attachment 372140 [details] [diff] [review]
v2

r=LpSolit

Comment 11

[Frédéric Buclin]

Max, could you commit this patch asap?

Comment 12

[Frédéric Buclin]

The tree is burning for 36 hours now. Committing the patch myself:

Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.562; previous revision: 1.561
done
Checking in editcomponents.cgi;
/cvsroot/mozilla/webtools/bugzilla/editcomponents.cgi,v  <--  editcomponents.cgi
new revision: 1.87; previous revision: 1.86
done
Checking in Bugzilla/Component.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Component.pm,v  <--  Component.pm
new revision: 1.17; previous revision: 1.16
done
Checking in Bugzilla/Constants.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Constants.pm,v  <--  Constants.pm
new revision: 1.113; previous revision: 1.112
done
Checking in Bugzilla/Install.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Install.pm,v  <--  Install.pm
new revision: 1.21; previous revision: 1.20
done
Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.185; previous revision: 1.184
done
Checking in template/en/default/admin/products/create.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/products/create.html.tmpl,v<--  create.html.tmpl
new revision: 1.7; previous revision: 1.6
done