Closed Bug 533794 Opened 16 years ago Closed 16 years ago

Suspicious action when trying to update bug via PUT

Categories

(Webtools Graveyard :: BzAPI, defect)

Product:
Webtools Graveyard
Component:
BzAPI
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

(Not tracked)

Status:
RESOLVED INVALID

People

(Reporter: adrianocola, Assigned: gerv)

Details

User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.30 Safari/532.5 Build Identifier: Bzapi 0.3; bugzilla 3.4.4 (with applied patches from the bzapi wiki) Tryed to make a update in a bug using the firefox addon RESTClient using te following parameters: Method: PUT URL: http://192.168.94.129:8080/bug/25?username=admin@admin.com&password=admin Request Headers: Content_Type text/xml Accept text/xml Request Body: <bugs summary="new name"></bugs> But received the error "Suspicious action". Reproducible: Always Actual Results: Repsonse from API: <opt> <data code="32000" error="1" html_page="&lt;!DOCTYPE html PUBLIC &quot;-//W3C//DTD HTML 4.01 Transitional//EN&quot; &quot;http://www.w3.org/TR/html4/loose.dtd&quot;&gt; &lt;html&gt; &lt;head&gt; &lt;title&gt;Suspicious Action&lt;/title&gt; &lt;link rel=&quot;Top&quot; href=&quot;http://192.168.93.129/bugzilla/&quot;&gt; &lt;link rel=&quot;Saved&amp;nbsp;Searches&quot; title=&quot;My Bugs&quot; href=&quot;buglist.cgi?bug_status=UNCONFIRMED&amp;amp;bug_status=NEW&amp;amp;bug_status=ASSIGNED&amp;amp;bug_status=REOPENED&amp;amp;emailassigned_to1=1&amp;amp;emailreporter1=1&amp;amp;emailtype1=exact&amp;amp;email1=admin%40admin.com&amp;amp;field0-0-0=bug_status&amp;amp;type0-0-0=notequals&amp;amp;value0-0-0=UNCONFIRMED&amp;amp;field0-0-1=reporter&amp;amp;type0-0-1=equals&amp;amp;value0-0-1=admin%40admin.com&quot;&gt; &lt;link rel=&quot;Administration&quot; title=&quot;Parameters&quot; href=&quot;editparams.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Users&quot; href=&quot;editusers.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Products&quot; href=&quot;editproducts.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Flag Types&quot; href=&quot;editflagtypes.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Groups&quot; href=&quot;editgroups.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Keywords&quot; href=&quot;editkeywords.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Whining&quot; href=&quot;editwhines.cgi&quot;&gt;&lt;link rel=&quot;Administration&quot; title=&quot;Sanity Check&quot; href=&quot;sanitycheck.cgi&quot;&gt; &lt;link href=&quot;skins/standard/global.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt; &lt;link href=&quot;skins/standard/global.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt; &lt;!--[if lte IE 7]&gt; &lt;link href=&quot;skins/standard/IE-fixes.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt; &lt;![endif]--&gt; &lt;link href=&quot;skins/standard/global.css&quot; rel=&quot;alternate stylesheet&quot; title=&quot;Classic&quot; type=&quot;text/css&quot;&gt; &lt;link href=&quot;skins/standard/global.css&quot; rel=&quot;alternate stylesheet&quot; title=&quot;Classic&quot; type=&quot;text/css&quot;&gt; &lt;!--[if lte IE 7]&gt; &lt;link href=&quot;skins/standard/IE-fixes.css&quot; rel=&quot;alternate stylesheet&quot; title=&quot;Classic&quot; type=&quot;text/css&quot;&gt; &lt;![endif]--&gt; &lt;link href=&quot;skins/contrib/Dusk/global.css&quot; rel=&quot;stylesheet&quot; title=&quot;Dusk&quot; type=&quot;text/css&quot;&gt; &lt;link href=&quot;skins/contrib/Dusk/global.css&quot; rel=&quot;stylesheet&quot; title=&quot;Dusk&quot; type=&quot;text/css&quot;&gt; &lt;!--[if lte IE 7]&gt; &lt;link href=&quot;skins/contrib/Dusk/IE-fixes.css&quot; rel=&quot;stylesheet&quot; title=&quot;Dusk&quot; type=&quot;text/css&quot;&gt; &lt;![endif]--&gt; &lt;link href=&quot;skins/custom/global.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt; &lt;link href=&quot;skins/custom/global.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt; &lt;!--[if lte IE 7]&gt; &lt;link href=&quot;skins/custom/IE-fixes.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt; &lt;![endif]--&gt; &lt;script src=&quot;js/yui/yahoo-dom-event.js&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt; &lt;script src=&quot;js/global.js&quot; type=&quot;text/javascript&quot;&gt;&lt;/script&gt; &lt;script type=&quot;text/javascript&quot;&gt; &lt;!-- YAHOO.namespace('bugzilla'); if (YAHOO.env.ua.gecko) { YAHOO.util.Event._simpleRemove(window, &quot;unload&quot;, YAHOO.util.Event._unload); } var BUGZILLA = { param: { cookiepath: '\/' } }; // --&gt; &lt;/script&gt; &lt;link rel=&quot;search&quot; type=&quot;application/opensearchdescription+xml&quot; title=&quot;Bugzilla&quot; href=&quot;./search_plugin.cgi&quot;&gt; &lt;link rel=&quot;shortcut icon&quot; href=&quot;images/favicon.ico&quot; &gt; &lt;/head&gt; &lt;body onload=&quot;&quot; class=&quot;192-168-93-129-bugzilla&quot;&gt; &lt;div id=&quot;header&quot;&gt; &lt;div id=&quot;banner&quot;&gt; &lt;/div&gt; &lt;table border=&quot;0&quot; cellspacing=&quot;0&quot; cellpadding=&quot;0&quot; id=&quot;titles&quot;&gt; &lt;tr&gt; &lt;td id=&quot;title&quot;&gt; &lt;p&gt;Bugzilla &amp;ndash; Suspicious Action&lt;/p&gt; &lt;/td&gt; &lt;/tr&gt; &lt;/table&gt; &lt;ul class=&quot;links&quot;&gt; &lt;li&gt;&lt;a href=&quot;./&quot;&gt;Home&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;enter_bug.cgi&quot;&gt;New&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;query.cgi&quot;&gt;Search&lt;/a&gt;&lt;/li&gt; &lt;li class=&quot;form&quot;&gt; &lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt; &lt;form action=&quot;buglist.cgi&quot; method=&quot;get&quot; onsubmit=&quot;if (this.quicksearch.value == '') { alert('Please enter one or more search terms first.'); return false; } return true;&quot;&gt; &lt;input class=&quot;txt&quot; type=&quot;text&quot; id=&quot;quicksearch_top&quot; name=&quot;quicksearch&quot;&gt; &lt;input class=&quot;btn&quot; type=&quot;submit&quot; value=&quot;Find&quot; id=&quot;find_top&quot;&gt;&lt;/form&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;report.cgi&quot;&gt;Reports&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;userprefs.cgi&quot;&gt;Preferences&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;admin.cgi&quot;&gt;Administration&lt;/a&gt;&lt;/li&gt; &lt;li&gt; &lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt; &lt;a href=&quot;index.cgi?logout=1&quot;&gt;Log&amp;nbsp;out&lt;/a&gt; admin&amp;#64;admin.com&lt;/li&gt; &lt;/ul&gt; &lt;/div&gt; &lt;div id=&quot;bugzilla-body&quot;&gt; &lt;div class=&quot;throw_error&quot;&gt; It looks like you didn't come from the right page. One reason could be that you entered the URL in the address bar of your web browser directly, which should be safe. Another reason could be that you clicked on a URL which redirected you here &lt;b&gt;without your consent&lt;/b&gt;. &lt;p&gt; Are you sure you want to commit these changes? &lt;/p&gt; &lt;/div&gt; &lt;form name=&quot;check&quot; id=&quot;check&quot; method=&quot;post&quot; action=&quot;process_bug.cgi&quot;&gt;&lt;input type=&quot;hidden&quot; name=&quot;confirm_product_change&quot; value=&quot;1&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;POSTDATA&quot; value=&quot;&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;longdesclength&quot; value=&quot;10000&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;id&quot; value=&quot;25&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;short_desc&quot; value=&quot;new name&quot;&gt; &lt;input type=&quot;hidden&quot; name=&quot;token&quot; value=&quot;1260384131-051ff262127017179f44047758204a05&quot;&gt; &lt;input type=&quot;submit&quot; id=&quot;confirm&quot; value=&quot;Yes, Confirm Changes&quot;&gt; &lt;/form&gt; &lt;p&gt;&lt;a href=&quot;index.cgi&quot;&gt;No, throw away these changes&lt;/a&gt; (you will be redirected to the home page).&lt;/p&gt; &lt;/div&gt; &lt;div id=&quot;footer&quot;&gt; &lt;div class=&quot;intro&quot;&gt;&lt;/div&gt; &lt;ul id=&quot;useful-links&quot;&gt; &lt;li id=&quot;links-actions&quot;&gt;&lt;ul class=&quot;links&quot;&gt; &lt;li&gt;&lt;a href=&quot;./&quot;&gt;Home&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;enter_bug.cgi&quot;&gt;New&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;query.cgi&quot;&gt;Search&lt;/a&gt;&lt;/li&gt; &lt;li class=&quot;form&quot;&gt; &lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt; &lt;form action=&quot;buglist.cgi&quot; method=&quot;get&quot; onsubmit=&quot;if (this.quicksearch.value == '') { alert('Please enter one or more search terms first.'); return false; } return true;&quot;&gt; &lt;input class=&quot;txt&quot; type=&quot;text&quot; id=&quot;quicksearch_bottom&quot; name=&quot;quicksearch&quot;&gt; &lt;input class=&quot;btn&quot; type=&quot;submit&quot; value=&quot;Find&quot; id=&quot;find_bottom&quot;&gt;&lt;/form&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;report.cgi&quot;&gt;Reports&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;userprefs.cgi&quot;&gt;Preferences&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt;&lt;a href=&quot;admin.cgi&quot;&gt;Administration&lt;/a&gt;&lt;/li&gt; &lt;li&gt; &lt;span class=&quot;separator&quot;&gt;| &lt;/span&gt; &lt;a href=&quot;index.cgi?logout=1&quot;&gt;Log&amp;nbsp;out&lt;/a&gt; admin&amp;#64;admin.com&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;li id=&quot;links-saved&quot;&gt; &lt;ul class=&quot;links&quot;&gt; &lt;li&gt;&lt;a href=&quot;buglist.cgi?bug_status=UNCONFIRMED&amp;amp;bug_status=NEW&amp;amp;bug_status=ASSIGNED&amp;amp;bug_status=REOPENED&amp;amp;emailassigned_to1=1&amp;amp;emailreporter1=1&amp;amp;emailtype1=exact&amp;amp;email1=admin%40admin.com&amp;amp;field0-0-0=bug_status&amp;amp;type0-0-0=notequals&amp;amp;value0-0-0=UNCONFIRMED&amp;amp;field0-0-1=reporter&amp;amp;type0-0-1=equals&amp;amp;value0-0-1=admin%40admin.com&quot;&gt;My Bugs&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;/ul&gt; &lt;div class=&quot;outro&quot;&gt;&lt;/div&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;" message="Unknown Bugzilla error. Title: 'Suspicious Action'" /> </opt> Expected Results: Bug updated on bugzilla OS Version: Ubuntu 9.10 Output from bugzilla's checksetup.pl: * This is Bugzilla 3.4.4 on perl 5.10.0 * Running on Linux 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:04:26 UTC 2009 Checking perl modules... Checking for CGI.pm (v3.33) ok: found v3.48 Checking for Digest-SHA (any) ok: found v5.45 Checking for TimeDate (v2.21) ok: found v2.22 Checking for DateTime (v0.28) ok: found v0.51 Checking for DateTime-TimeZone (v0.71) ok: found v1.05 Checking for DBI (v1.41) ok: found v1.609 Checking for Template-Toolkit (v2.22) ok: found v2.22 Checking for Email-Send (v2.00) ok: found v2.198 Checking for Email-MIME (v1.861) ok: found v1.902 Checking for Email-MIME-Encodings (v1.313) ok: found v1.313 Checking for Email-MIME-Modifier (v1.442) ok: found v1.902 Checking for URI (any) ok: found v1.37 Checking available perl DBD modules... Checking for DBD-Pg (v1.45) not found Checking for DBD-mysql (v4.00) ok: found v4.011 Checking for DBD-Oracle (v1.19) not found The following Perl modules are optional: Checking for GD (v1.20) ok: found v2.39 Checking for Chart (v1.0) not found Checking for Template-GD (any) not found Checking for GDTextUtil (any) not found Checking for GDGraph (any) not found Checking for XML-Twig (any) ok: found v3.32 Checking for MIME-tools (v5.406) not found Checking for libwww-perl (any) ok: found v5.829 Checking for PatchReader (v0.9.4) not found Checking for PerlMagick (any) not found Checking for perl-ldap (any) not found Checking for Authen-SASL (any) not found Checking for RadiusPerl (any) not found Checking for SOAP-Lite (v0.710.06) ok: found v0.710.10 Checking for HTML-Parser (v3.40) ok: found v3.61 Checking for HTML-Scrubber (any) ok: found v0.08 Checking for Email-MIME-Attachment-Stripper (any) not found Checking for Email-Reply (any) not found Checking for TheSchwartz (any) not found Checking for Daemon-Generic (any) not found Checking for mod_perl (v1.999022) not found *********************************************************************** * OPTIONAL MODULES * *********************************************************************** * Certain Perl modules are not required by Bugzilla, but by * * installing the latest version you gain access to additional * * features. * * * * The optional modules you do not have installed are listed below, * * with the name of the feature they enable. Below that table are the * * commands to install each module. * *********************************************************************** * MODULE NAME * ENABLES FEATURE(S) * *********************************************************************** * Chart * New Charts, Old Charts * * Template-GD * Graphical Reports * * GDTextUtil * Graphical Reports * * GDGraph * Graphical Reports * * MIME-tools * Move Bugs Between Installations * * PatchReader * Patch Viewer * * PerlMagick * Optionally Convert BMP Attachments to PNGs * * perl-ldap * LDAP Authentication * * Authen-SASL * SMTP Authentication * * RadiusPerl * RADIUS Authentication * * Email-MIME-Attachment-Stripper * Inbound Email * * Email-Reply * Inbound Email * * TheSchwartz * Mail Queueing * * Daemon-Generic * Mail Queueing * * mod_perl * mod_perl * *********************************************************************** COMMANDS TO INSTALL OPTIONAL MODULES: Chart: /usr/bin/perl install-module.pl Chart::Base Template-GD: /usr/bin/perl install-module.pl Template::Plugin::GD::Image GDTextUtil: /usr/bin/perl install-module.pl GD::Text GDGraph: /usr/bin/perl install-module.pl GD::Graph MIME-tools: /usr/bin/perl install-module.pl MIME::Parser PatchReader: /usr/bin/perl install-module.pl PatchReader PerlMagick: /usr/bin/perl install-module.pl Image::Magick perl-ldap: /usr/bin/perl install-module.pl Net::LDAP Authen-SASL: /usr/bin/perl install-module.pl Authen::SASL RadiusPerl: /usr/bin/perl install-module.pl Authen::Radius Email-MIME-Attachment-Stripper: /usr/bin/perl install-module.pl Email::MIME::Attachment::Stripper Email-Reply: /usr/bin/perl install-module.pl Email::Reply TheSchwartz: /usr/bin/perl install-module.pl TheSchwartz Daemon-Generic: /usr/bin/perl install-module.pl Daemon::Generic mod_perl: /usr/bin/perl install-module.pl mod_perl2 To attempt an automatic install of every required and optional module with one command, do: /usr/bin/perl install-module.pl --all Reading ./localconfig... OPTIONAL NOTE: If you want to be able to use the 'difference between two patches' feature of Bugzilla (which requires the PatchReader Perl module as well), you should install patchutils from: http://cyberelk.net/tim/patchutils/ Checking for DBD-mysql (v4.00) ok: found v4.011 Checking for MySQL (v4.1.2) ok: found v5.1.37-1ubuntu5 Removing existing compiled templates... Precompiling templates...done. Fixing file permissions...
Sorry, this is not well documented. You need to submit a token for bug updates to work. You can get a token by requesting the bug using GET, and looking at the "token" member of the returned object. This is to prevent cross-site request forgery. Gerv
Now worked! I was doing my GETs without doing login, so I wasn't receiving the token! Thank you!
Adriano: super. :-) Have you installed your own installation of the Bugzilla API to point at your Bugzilla? If so, any feedback you have on the installation instructions would be very useful. Gerv
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → INVALID
Installed the bzapi in a Windows and a Ubuntu environment. Both also with the Bugzilla server. Ubuntu Installation: To start the installation I followed the steps in the INSTALL example. Then tried to run bugzilla_api_server.pl and installed the packages it requested. To get it working, installed the folowing packages: BZ::Client Array::Diff Slurp Moose Test::More Catalyst::Controller::REST Catalyst::Plugin::Log::Handler Catalyst Data::Walk I had to install the optional package SOAP::LITE described in the bugzilla installation to use the Bzapi, that wasn't very well documented. (I'm not a bugzilla expert =P ) Then applied the the 2 patches described in the documentation In the next comment I will describe the windows installation.
Resolution: INVALID → FIXED
Resolution: FIXED → INVALID
Adriano: thanks, that's very helpful :-) I'm looking forward to the Windows information. Gerv
To install on windows I followed the same steps I did in the Ubuntu installation. Executed the server and installed the requested perl packages. But I got a little issue with the log. Got the following messages when starting the server: Can't locate Log/Handler/Output/Minlevel.pm in @INC (@INC contains: C:/bzapi/scr ipt/../lib C:/Perl/site/lib C:/Perl/lib .) at (eval 436) line 3. at C:/Perl/site/lib/Catalyst/Plugin/Log/Handler.pm line 83 Compilation failed in require at bugzilla_api_server.pl line 55. Tried to install the package "Log:Handler:Output::Minlevel" but didn't found one. And the installation of Log::Handler::Output says "No missing packages to install". So I commented the following lines in the file Catalyst\Plugin\Log\Handler.pm: $self->handler(Log::Handler->new( #minlevel => 0, #maxlevel => 7, #%$config, )); And now works, but don't log! Thank you!
Adriano: this URL: http://cpantesters.org/distro/C/Catalyst-Plugin-Log-Handler.html suggests to me that recent versions of that module are broken. Have you tried using an earlier one? Of course, if you don't need logging, it's not so important. But it would be helpful to me to know if downgrading the module fixes the problem. Gerv
Product: Webtools → Webtools Graveyard
You need to log in before you can comment on or make changes to this bug.