724893 - Non-admins should be allowed to "list" field values with editvalues.cgi

Status: RESOLVED WONTFIX

(Bugzilla :: Administration, task)

Description

[Kent Rogers [:mrbball]]

Attachment: Mod to adapt editvalues.cgi to also list the values for non-admins

Currently there is no way for non-admins to get a simple listing of
the legal values for the fields whose values must belong to some
given list (e.g. Platform). The only way to do this now is to go to
the search page and look at the field values that are available to
be used as search criteria. That's not great.

The editvalues.cgi script, which is normally used by admins to
create/update/delete field values, already contains almost all of
the necessary logic and only needs a few small tweaks to be able to
list field values for non-admins.

I realize this capability is already available via the WebServices
interface, but it would also be quite useful via the http interface,
for external programs that use that interface and want to get the
list of valid values.  I have found this extremely useful for
keeping Bugzilla in sync with external systems.

I have attached a simple patch (applies to tip) to implement the
suggestion.

Comment 1

[Frédéric Buclin]

(In reply to Kent Rogers [mrbball] from comment #0)
> I realize this capability is already available via the WebServices
> interface, but it would also be quite useful via the http interface,

That's not the right way to get data from HTTP, because external applications would have to parse the HTML page to extract relevant data (good luck!). External applications can already access e.g. https://bugzilla.mozilla.org/config.cgi?ctype=rdf which contains all the relevant data they may need, in a format which is easy to parse.

So I see no other valid reasons to let lambda users access editvalues.cgi.

Comment 2

[Frédéric Buclin]

Comment on attachment 595034 [details] [diff] [review]
Mod to adapt editvalues.cgi to also list the values for non-admins

For the reason given in the previous comment.

Comment 3

[Kent Rogers [:mrbball]]

> External applications can already access e.g.
> https://bugzilla.mozilla.org/config.cgi?ctype=rdf which contains all the
> relevant data they may need, in a format which is easy to parse.
> 
True, but it's also nice to be able to access the information via the web
interface.  Is there a link to the above CGI in the web interface?

Comment 4

[Frédéric Buclin]

(In reply to Kent Rogers [mrbball] from comment #3)
> Is there a link to the above CGI in the web interface?

No such link, no.

Comment 5

[Kent Rogers [:mrbball]]

Which is one reason I would still like to see this functionality.  Also,
the display I get when I run config.cgi?ctype=rdf is not very user
friendly.

The code is pretty minor and simply adds a 'list' action to editvalues.cgi.
All the other logic already exists.

Would you reconsider?

Comment 6

[Frédéric Buclin]

(In reply to Kent Rogers [mrbball] from comment #5)
> Which is one reason I would still like to see this functionality.  Also,
> the display I get when I run config.cgi?ctype=rdf is not very user
> friendly.

It's job is to be machine-parsable, not human-readable.


> The code is pretty minor and simply adds a 'list' action to editvalues.cgi.
> All the other logic already exists.
> 
> Would you reconsider?

No, I still pretend that the average user doesn't need to have access to these lists, nor is interested to see them. Some values may also be inactive, or used only in some products or components, and so the lists in editvalues.cgi may differ from what the user could see in query.cgi. I don't want to open this can of worms.

Comment 7

[Kent Rogers [:mrbball]]

(In reply to Frédéric Buclin from comment #6)
> It's job is to be machine-parsable, not human-readable.
> 
Exactly!

> 
> No, I still pretend that the average user doesn't need to have access to
> these lists, nor is interested to see them. Some values may also be
> inactive, or used only in some products or components, and so the lists in
> editvalues.cgi may differ from what the user could see in query.cgi. I don't
> want to open this can of worms.
>
Whether or not a value is inactive is already listed.  That's part of the existing
logic I mentioned.

Unfortunately, I guess this will have to be another local customization ...