947141 - Put "Powered by Bugzilla 5.6.7" in footer of all pages of all sites

Status: RESOLVED WONTFIX

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Dan Jacobson]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0 Iceweasel/27.0a2 (Beta/Release)
Build ID: 20131115004004

Steps to reproduce:

Entered a bugzilla bug just like I am doing now, and was asked the version before being allowed to proceed.


Actual results:

Had to guess the version.


Expected results:

The circle with the question mark in it should say how to determine the version.

It's not even in the HTML source header or footer.

Comment 1

[Dan Jacobson]

No not everybody is the superuser.

Comment 2

[Frédéric Buclin]

Only bmo asks you the version in the guided form. We don't ask for it upstream.

Comment 3

[:glob ✱]

(In reply to Frédéric Buclin from comment #2)
> Only bmo asks you the version in the guided form. We don't ask for it
> upstream.

this isn't true at all -- the version field is mandatory in all versions of bugzilla.


adding specific per-product information on how to determine its version would be time consuming and problematic.  we're better off amending the help blurb to say something like "if you aren't sure, guess".

Comment 4

[Dan Jacobson]

Most people are afraid of getting shouted at for being too lazy to determine the version.

And try as they might they can't figure out the version.

And only 50% will ever hit that question mark help blurb.

Anyway, the help blurb or always present exposed message should say "The version is often hidden for security reasons, don't bother looking for it if you don't know it in the first place" or something.

Comment 5

[:glob ✱]

(In reply to jidanni from comment #4)
> Anyway, the help blurb or always present exposed message should say "The
> version is often hidden for security reasons, don't bother looking for it if
> you don't know it in the first place" or something.

i'm not aware of any mozilla products tracked in bugzilla where the version number is hidden for that reason.

the fact it's missing from bmo's index page is an oversight and will be resolved next week.

Comment 6

[Frédéric Buclin]

(In reply to Byron Jones ‹:glob› from comment #3)
> this isn't true at all -- the version field is mandatory in all versions of
> bugzilla.

https://landfill.bugzilla.org/bugzilla-tip/enter_bug.cgi?product=WorldControl&format=guided

No version requested.

Comment 7

[:glob ✱]

for issues with BMO we don't have a specific version (it's just "production", or currently "2015.04.28").

for upstream bugzilla issues referencing bmo's version isn't useful, and providing help for finding the version number in other bugzilla installations isn't worth the effort i'm sorry.  if we need the version number it's easy to ask the reporter and provide guidance at that point (spoiler: it's on the home page, in the header - https://bugzilla.mozilla.org/ ).

Comment 8

[Dan Jacobson]

Sorry but here I am back again trying very very hard to determine what
version of bugzilla various sites are running.

Why would I want to do that? To hack them? No. Usually to tell site A
that behavior X does not happen on site B because their they already use
bugzilla version Q etc. etc. In no cases am I an administrator.

Poking around each bugzilla installation, one finds no obvious way to
determine the version. In fact there is little buzilla "branding" if
any. No familiar version in the footer, etc.

OK let's get to work trying to determine the bugzilla versions.

$ set https://bugs.webkit.org/ https://bugzilla.mozilla.org/ https://bugzilla.gnome.org/
$ for i do echo $i :; w3m -no-cookie -dump $i|grep -i version; done
https://bugs.webkit.org/ :
https://bugzilla.mozilla.org/ :
version 2017.07.12
https://bugzilla.gnome.org/ :
GNOME Bugzilla – Main Page version 4.4.12

So
1) one still has no systematic way to detect the version.
2) one still has no systematic way to compare the version.

So I hope the next time each site upgrades their bugzilla installation, it will then be easier for outsiders like me to probe their version.

Comment 9

[Dan Jacobson]

I'll rehabilitate this bug report:

See that list of a hundred+ bugzillas
https://www.bugzilla.org/installation-list/ ?

OK, I would like there to be a shell script that would be guaranteed to
determine the version of bugzilla running on any of them when given
their URL. The script should work when executed by anybody on the net
anywhere, who knows nothing more about the site than the URL.

And hopefully give both versions, the 2017-07-07 style version and the
4.5.6 style version.

Why a shell script? Well that's because as we see the version is not
always on the front page, but somewhere in the guts.

(I faced the same problem with phpBB. I had to write this script to
get installations to cough up their version numbers.

for site in forum.bdsmtw.com lustfulshemale.org/phpBB3; do \
S=http://$site; echo $S ==============; \
: || w3m -dump $S/docs/CHANGELOG.html |\
perl -nwle 'if(/since/){print; $OK=1; exit;}END{die unless $OK;}' ;\
w3m -dump $S/styles/prosilver/style.cfg|grep -i version.*[0-9]$; done
http://forum.bdsmtw.com ==============
version = 3.0.12
http://lustfulshemale.org/phpBB3 ==============
style_version = 3.1.9
phpbb_version = 3.1.9

Because the phpBB people think making the version more visible invites hacks.)

Also if I were you bugzilla people, I would put a "Powered by Buzilla
5.6.7" in a permanent place in the footer of all pages of all those
hundred+ bugzillas next upgrade, that they couldn't mess with. Then
there would be no more need for my requested shell script one day.

OK what if there is a site that thinks it is very important to hide
their bugzillas version number... well let them reopen this bug.

Comment 10

[Kohei Yoshino [:kohei]]

The version number a tech detail that general users never have to know about. I'd recommend against exposing it. See my global navigation analysis: https://kyoshino.github.io/bugzilla-ux/global-navigation-analysis/

My recommendation is to use the standard meta generator tag: https://html.spec.whatwg.org/multipage/semantics.html#meta-generator

Comment 11

[Dan Jacobson]

Don't remove it! OK if you remove it be sure it is guaranteed to still be in the HTML source of each page a site generates, yes in the meta tags, or if not, even if only within an HTML comment. By the way, what version is https://bugs.webkit.org/ running? Hard to tell, no?

Comment 12

[Dan Jacobson]

Also please don't force a user to (try to) make an account on a bugzilla just to obtain the version. (Before is appears in the HTML.)

Comment 13

[Kohei Yoshino [:kohei]]

(In reply to Dan Jacobson from comment #11)
> By the way, what version is https://bugs.webkit.org/ running? Hard to tell, no?

https://bugs.webkit.org/rest/version

Comment 14

[Dan Jacobson]

Thanks! But I am still comparing apples (5.0.3) to oranges (20170712.1) to bananas "(404 NOT FOUND)".
$ cat ee.sh
for i in https://bugs.webkit.org/ https://bugzilla.mozilla.org/ https://bugzilla.gnome.org/
do echo $i :; GET ${i}rest/version; echo; done
$ sh ee.sh 
https://bugs.webkit.org/ :
{"version":"5.0.3"}
https://bugzilla.mozilla.org/ :
{"version":"20170712.1"}
https://bugzilla.gnome.org/ :
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /rest/version was not found on this server.</p>
<hr>
<address>Apache/2.2.15 (Red Hat) Server at bugzilla.gnome.org Port 443</address>
</body></html>

Is there any better guaranteed way?
Or if each site upgrades, will they all reliably return the rest/version or will some sites still disable it and thus one cannot tell what version they are running by probing over the net?

Comment 15

[:glob ✱]

most bugzilla sites are customised, there's no guaranteed way to determine the version number, nor can a project whose users make such customisations provide the function you're asking for.

with regards to bmo, the version number is meaningless; you'll note it's date based as it is only loosely attached to an upstream released version.  i agree with kohei that there's no value in exposing that on our ui.

Comment 16

[Dan Jacobson]

https://blogs.kde.org/2005/08/02/importance-version-numbers

You are assuming nobody would ever find a bug in a bugzilla that they
were not the administrator of, and wish to report it.

You are assuming the only people that would ever wish to report a
bugzilla bug are the administrator of their bugzilla.

What if one day a site goes berserk and nobody can deal with it, not even the adminisitrator.
Wouldn't it be good to be able to ascertain the version number?

Comment 17

[Dylan Hardison [:dylan] (he/him)]

(In reply to Dan Jacobson from comment #16)
> What if one day a site goes berserk and nobody can deal with it, not even
> the adminisitrator.
> Wouldn't it be good to be able to ascertain the version number?

Not really, the version number doesn't tell you much if they've customized, as glob has pointed out.
In that case you'd best to contact the host / netblock owner.

I can't really force this behavior on sites. Many security teams don't like reporting version information at all and will just patch around anything we add.

For BMO, we're quite open with what is in a release: there is a git tag and an update on https://wiki.mozilla.org/BMO/Recent_Changes, a blog post and an email sent to a tools mailing list.

Comment 18

[Dan Jacobson]

Yes it seems they can even customize it to say "Powered by
{some_competing_bug_tracker}". Sigh.

Anyway in some FAQ somewhere, please document common methods to probe a bugzilla
version, in case one is asked when filling out a bug report...
That faq#version would be linked next to the version question on the bug
report form.

It would say:

To obtain the version of a bugzilla installation:
1. If you are the administrator, look in ....
2. If you are not the administrator, check
2.1 The front page
2.2 ...rest/version
2.3
If you still cannot find the version, the administrator has probably
hidden it. Please select "unknown".

Thanks.