BugsSite/buglist.cgi

   1 #!/usr/bin/perl -wT
   2 # -*- Mode: perl; indent-tabs-mode: nil -*-
   3 #
   4 # The contents of this file are subject to the Mozilla Public
   5 # License Version 1.1 (the "License"); you may not use this file
   6 # except in compliance with the License. You may obtain a copy of
   7 # the License at http://www.mozilla.org/MPL/
   8 #
   9 # Software distributed under the License is distributed on an "AS
  10 # IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  11 # implied. See the License for the specific language governing
  12 # rights and limitations under the License.
  13 #
  14 # The Original Code is the Bugzilla Bug Tracking System.
  15 #
  16 # The Initial Developer of the Original Code is Netscape Communications
  17 # Corporation. Portions created by Netscape are
  18 # Copyright (C) 1998 Netscape Communications Corporation. All
  19 # Rights Reserved.
  20 #
  21 # Contributor(s): Terry Weissman <terry@mozilla.org>
  22 #                 Dan Mosedale <dmose@mozilla.org>
  23 #                 Stephan Niemz  <st.n@gmx.net>
  24 #                 Andreas Franke <afranke@mathweb.org>
  25 #                 Myk Melez <myk@mozilla.org>
  26 #                 Max Kanat-Alexander <mkanat@bugzilla.org>
  27
  28 ################################################################################
  29 # Script Initialization
  30 ################################################################################
  31
  32 # Make it harder for us to do dangerous things in Perl.
  33 use strict;
  34
  35 use lib qw(.);
  36
  37 use vars qw($template $vars);
  38
  39 use Bugzilla;
  40 use Bugzilla::Search;
  41 use Bugzilla::Constants;
  42 use Bugzilla::User;
  43
  44 # Include the Bugzilla CGI and general utility library.
  45 require "CGI.pl";
  46
  47 use vars qw($db_name
  48             @components
  49             @legal_keywords
  50             @legal_platform
  51             @legal_priority
  52             @legal_product
  53             @legal_severity
  54             @settable_resolution
  55             @target_milestone
  56             $userid
  57             @versions);
  58
  59 my $cgi = Bugzilla->cgi;
  60 my $dbh = Bugzilla->dbh;
  61
  62 # We have to check the login here to get the correct footer
  63 # if an error is thrown.
  64 Bugzilla->login();
  65
  66 if (length($::buffer) == 0) {
  67     print $cgi->header(-refresh=> '10; URL=query.cgi');
  68     ThrowUserError("buglist_parameters_required");
  69 }
  70
  71 ################################################################################
  72 # Data and Security Validation
  73 ################################################################################
  74
  75 # Whether or not the user wants to change multiple bugs.
  76 my $dotweak = $cgi->param('tweak') ? 1 : 0;
  77
  78 # Log the user in
  79 if ($dotweak) {
  80     Bugzilla->login(LOGIN_REQUIRED);
  81     UserInGroup("editbugs")
  82       || ThrowUserError("auth_failure", {group  => "editbugs",
  83                                          action => "modify",
  84                                          object => "multiple_bugs"});
  85     GetVersionTable();
  86 }
  87
  88 # Hack to support legacy applications that think the RDF ctype is at format=rdf.
  89 if (defined $cgi->param('format') && $cgi->param('format') eq "rdf"
  90     && !defined $cgi->param('ctype')) {
  91     $cgi->param('ctype', "rdf");
  92     $cgi->delete('format');
  93 }
  94
  95 # Treat requests for ctype=rss as requests for ctype=atom
  96 if (defined $cgi->param('ctype') && $cgi->param('ctype') eq "rss") {
  97     $cgi->param('ctype', "atom");
  98 }
  99
 100 # The js ctype presents a security risk; a malicious site could use it
 101 # to gather information about secure bugs. So, we only allow public bugs to be
 102 # retrieved with this format.
 103 #
 104 # Note that if and when this call clears cookies or has other persistent
 105 # effects, we'll need to do this another way instead.
 106 if ((defined $cgi->param('ctype')) && ($cgi->param('ctype') eq "js")) {
 107     Bugzilla->logout_request();
 108 }
 109
 110 # Determine the format in which the user would like to receive the output.
 111 # Uses the default format if the user did not specify an output format;
 112 # otherwise validates the user's choice against the list of available formats.
 113 my $format = GetFormat("list/list", scalar $cgi->param('format'),
 114                        scalar $cgi->param('ctype'));
 115
 116 # Use server push to display a "Please wait..." message for the user while
 117 # executing their query if their browser supports it and they are viewing
 118 # the bug list as HTML and they have not disabled it by adding &serverpush=0
 119 # to the URL.
 120 #
 121 # Server push is a Netscape 3+ hack incompatible with MSIE, Lynx, and others.
 122 # Even Communicator 4.51 has bugs with it, especially during page reload.
 123 # http://www.browsercaps.org used as source of compatible browsers.
 124 #
 125 my $serverpush =
 126   $format->{'extension'} eq "html"
 127     && exists $ENV{'HTTP_USER_AGENT'}
 128       && $ENV{'HTTP_USER_AGENT'} =~ /Mozilla.[3-9]/
 129         && $ENV{'HTTP_USER_AGENT'} !~ /[Cc]ompatible/
 130           && $ENV{'HTTP_USER_AGENT'} !~ /WebKit/
 131             && !defined($cgi->param('serverpush'))
 132               || $cgi->param('serverpush');
 133
 134 my $order = $cgi->param('order') || "";
 135 my $order_from_cookie = 0;  # True if $order set using the LASTORDER cookie
 136
 137 # The params object to use for the actual query itself
 138 my $params;
 139
 140 # If the user is retrieving the last bug list they looked at, hack the buffer
 141 # storing the query string so that it looks like a query retrieving those bugs.
 142 if (defined $cgi->param('regetlastlist')) {
 143     $cgi->cookie('BUGLIST') || ThrowUserError("missing_cookie");
 144
 145     $order = "reuse last sort" unless $order;
 146     my $bug_id = $cgi->cookie('BUGLIST');
 147     $bug_id =~ s/:/,/g;
 148     # set up the params for this new query
 149     $params = new Bugzilla::CGI({
 150                                  bug_id => $bug_id,
 151                                  order => $order,
 152                                 });
 153 }
 154
 155 if ($::buffer =~ /&cmd-/) {
 156     my $url = "query.cgi?$::buffer#chart";
 157     print $cgi->redirect(-location => $url);
 158     # Generate and return the UI (HTML page) from the appropriate template.
 159     $vars->{'message'} = "buglist_adding_field";
 160     $vars->{'url'} = $url;
 161     $template->process("global/message.html.tmpl", $vars)
 162       || ThrowTemplateError($template->error());
 163     exit;
 164 }
 165
 166 # Figure out whether or not the user is doing a fulltext search.  If not,
 167 # we'll remove the relevance column from the lists of columns to display
 168 # and order by, since relevance only exists when doing a fulltext search.
 169 my $fulltext = 0;
 170 if ($cgi->param('content')) { $fulltext = 1 }
 171 my @charts = map(/^field(\d-\d-\d)$/ ? $1 : (), $cgi->param());
 172 foreach my $chart (@charts) {
 173     if ($cgi->param("field$chart") eq 'content' && $cgi->param("value$chart")) {
 174         $fulltext = 1;
 175         last;
 176     }
 177 }
 178
 179 ################################################################################
 180 # Utilities
 181 ################################################################################
 182
 183 my @weekday= qw( Sun Mon Tue Wed Thu Fri Sat );
 184 sub DiffDate {
 185     my ($datestr) = @_;
 186     my $date = str2time($datestr);
 187     my $age = time() - $date;
 188     my ($s,$m,$h,$d,$mo,$y,$wd)= localtime $date;
 189     if( $age < 18*60*60 ) {
 190         $date = sprintf "%02d:%02d:%02d", $h,$m,$s;
 191     } elsif( $age < 6*24*60*60 ) {
 192         $date = sprintf "%s %02d:%02d", $weekday[$wd],$h,$m;
 193     } else {
 194         $date = sprintf "%04d-%02d-%02d", 1900+$y,$mo+1,$d;
 195     }
 196     return $date;
 197 }
 198
 199 sub LookupNamedQuery {
 200     my ($name) = @_;
 201     Bugzilla->login(LOGIN_REQUIRED);
 202     my $dbh = Bugzilla->dbh;
 203     # $name is safe -- we only use it below in a SELECT placeholder and then
 204     # in error messages (which are always HTML-filtered).
 205     trick_taint($name);
 206     my $result = $dbh->selectrow_array("SELECT query FROM namedqueries"
 207                           . " WHERE userid = ? AND name = ?"
 208                           , undef, (Bugzilla->user->id, $name));
 209
 210     defined($result) || ThrowUserError("missing_query", {'queryname' => $name});
 211     $result
 212        || ThrowUserError("buglist_parameters_required", {'queryname' => $name});
 213
 214     return $result;
 215 }
 216
 217 # Inserts a Named Query (a "Saved Search") into the database, or
 218 # updates a Named Query that already exists..
 219 # Takes four arguments:
 220 # userid - The userid who the Named Query will belong to.
 221 # query_name - A string that names the new Named Query, or the name
 222 #              of an old Named Query to update. If this is blank, we
 223 #              will throw a UserError. Leading and trailing whitespace
 224 #              will be stripped from this value before it is inserted
 225 #              into the DB.
 226 # query - The query part of the buglist.cgi URL, unencoded. Must not be
 227 #         empty, or we will throw a UserError.
 228 # link_in_footer (optional) - 1 if the Named Query should be
 229 # displayed in the user's footer, 0 otherwise.
 230 #
 231 # All parameters are validated before passing them into the database.
 232 #
 233 # Returns: A boolean true value if the query existed in the database
 234 # before, and we updated it. A boolean false value otherwise.
 235 sub InsertNamedQuery ($$$;$) {
 236     my ($userid, $query_name, $query, $link_in_footer) = @_;
 237     $link_in_footer ||= 0;
 238     $query_name = trim($query_name);
 239     Bugzilla->login(LOGIN_REQUIRED);
 240     my $dbh = Bugzilla->dbh;
 241     my $query_existed_before;
 242
 243     # Validate the query name.
 244     $query_name || ThrowUserError("query_name_missing");
 245     $query_name !~ /[<>&]/ || ThrowUserError("illegal_query_name");
 246     (length($query_name) <= 64) || ThrowUserError("query_name_too_long");
 247     trick_taint($query_name);
 248
 249     detaint_natural($userid);
 250     detaint_natural($link_in_footer);
 251
 252     $query || ThrowUserError("buglist_parameters_required",
 253                              {'queryname' => $query});
 254     # $query is safe, because we always urlencode or html_quote
 255     # it when we display it to the user.
 256     trick_taint($query);
 257
 258     $dbh->bz_lock_tables('namedqueries WRITE');
 259
 260     my $result = $dbh->selectrow_array("SELECT userid FROM namedqueries"
 261         . " WHERE userid = ? AND name = ?"
 262         , undef, ($userid, $query_name));
 263     if ($result) {
 264         $query_existed_before = 1;
 265         $dbh->do("UPDATE namedqueries"
 266             . " SET query = ?, linkinfooter = ?"
 267             . " WHERE userid = ? AND name = ?"
 268             , undef, ($query, $link_in_footer, $userid, $query_name));
 269     } else {
 270         $query_existed_before = 0;
 271         $dbh->do("INSERT INTO namedqueries"
 272             . " (userid, name, query, linkinfooter)"
 273             . " VALUES (?, ?, ?, ?)"
 274             , undef, ($userid, $query_name, $query, $link_in_footer));
 275     }
 276
 277     $dbh->bz_unlock_tables();
 278     return $query_existed_before;
 279 }
 280
 281 sub LookupSeries {
 282     my ($series_id) = @_;
 283     detaint_natural($series_id) || ThrowCodeError("invalid_series_id");
 284
 285     my $dbh = Bugzilla->dbh;
 286     my $result = $dbh->selectrow_array("SELECT query FROM series " .
 287                                        "WHERE series_id = ?"
 288                                        , undef, ($series_id));
 289     $result
 290            || ThrowCodeError("invalid_series_id", {'series_id' => $series_id});
 291     return $result;
 292 }
 293
 294 sub GetQuip {
 295     my $dbh = Bugzilla->dbh;
 296     # COUNT is quick because it is cached for MySQL. We may want to revisit
 297     # this when we support other databases.
 298     my $count = $dbh->selectrow_array("SELECT COUNT(quip)"
 299                                     . " FROM quips WHERE approved = 1");
 300     my $random = int(rand($count));
 301     my $quip =
 302         $dbh->selectrow_array("SELECT quip FROM quips WHERE approved = 1 " .
 303                               $dbh->sql_limit(1, $random));
 304     return $quip;
 305 }
 306
 307 sub GetGroupsByUserId {
 308     my ($userid) = @_;
 309     my $dbh = Bugzilla->dbh;
 310
 311     return if !$userid;
 312
 313     # Create an array where each item is a hash. The hash contains
 314     # as keys the name of the columns, which point to the value of
 315     # the columns for that row.
 316     my $groups = $dbh->selectall_arrayref(
 317        "SELECT DISTINCT  groups.id, name, description, isactive
 318                    FROM  groups
 319              INNER JOIN  user_group_map
 320                      ON  user_group_map.group_id = groups.id
 321                   WHERE  user_id = ?
 322                     AND  isbless = 0
 323                     AND  isbuggroup = 1
 324                ORDER BY  description "
 325                , {Slice => {}}, ($userid));
 326
 327     return $groups;
 328 }
 329
 330
 331 ################################################################################
 332 # Command Execution
 333 ################################################################################
 334
 335 $cgi->param('cmdtype', "") if !defined $cgi->param('cmdtype');
 336 $cgi->param('remaction', "") if !defined $cgi->param('remaction');
 337
 338 # Backwards-compatibility - the old interface had cmdtype="runnamed" to run
 339 # a named command, and we can't break this because it's in bookmarks.
 340 if ($cgi->param('cmdtype') eq "runnamed") {
 341     $cgi->param('cmdtype', "dorem");
 342     $cgi->param('remaction', "run");
 343 }
 344
 345 # Now we're going to be running, so ensure that the params object is set up,
 346 # using ||= so that we only do so if someone hasn't overridden this
 347 # earlier, for example by setting up a named query search.
 348
 349 # This will be modified, so make a copy.
 350 $params ||= new Bugzilla::CGI($cgi);
 351
 352 # Generate a reasonable filename for the user agent to suggest to the user
 353 # when the user saves the bug list.  Uses the name of the remembered query
 354 # if available.  We have to do this now, even though we return HTTP headers
 355 # at the end, because the fact that there is a remembered query gets
 356 # forgotten in the process of retrieving it.
 357 my @time = localtime(time());
 358 my $date = sprintf "%04d-%02d-%02d", 1900+$time[5],$time[4]+1,$time[3];
 359 my $filename = "bugs-$date.$format->{extension}";
 360 if ($cgi->param('cmdtype') eq "dorem" && $cgi->param('remaction') =~ /^run/) {
 361     $filename = $cgi->param('namedcmd') . "-$date.$format->{extension}";
 362     # Remove white-space from the filename so the user cannot tamper
 363     # with the HTTP headers.
 364     $filename =~ s/\s/_/g;
 365 }
 366
 367 # Take appropriate action based on user's request.
 368 if ($cgi->param('cmdtype') eq "dorem") {
 369     if ($cgi->param('remaction') eq "run") {
 370         $::buffer = LookupNamedQuery(scalar $cgi->param("namedcmd"));
 371         $vars->{'searchname'} = $cgi->param('namedcmd');
 372         $vars->{'searchtype'} = "saved";
 373         $params = new Bugzilla::CGI($::buffer);
 374         $order = $params->param('order') || $order;
 375
 376     }
 377     elsif ($cgi->param('remaction') eq "runseries") {
 378         $::buffer = LookupSeries(scalar $cgi->param("series_id"));
 379         $vars->{'searchname'} = $cgi->param('namedcmd');
 380         $vars->{'searchtype'} = "series";
 381         $params = new Bugzilla::CGI($::buffer);
 382         $order = $params->param('order') || $order;
 383     }
 384     elsif ($cgi->param('remaction') eq "forget") {
 385         Bugzilla->login(LOGIN_REQUIRED);
 386         # Copy the name into a variable, so that we can trick_taint it for
 387         # the DB. We know it's safe, because we're using placeholders in
 388         # the SQL, and the SQL is only a DELETE.
 389         my $qname = $cgi->param('namedcmd');
 390         trick_taint($qname);
 391
 392         # Do not forget the saved search if it is being used in a whine
 393         my $whines_in_use =
 394             $dbh->selectcol_arrayref('SELECT DISTINCT whine_events.subject
 395                                                  FROM whine_events
 396                                            INNER JOIN whine_queries
 397                                                    ON whine_queries.eventid
 398                                                       = whine_events.id
 399                                                 WHERE whine_events.owner_userid
 400                                                       = ?
 401                                                   AND whine_queries.query_name
 402                                                       = ?
 403                                       ', undef, Bugzilla->user->id, $qname);
 404         if (scalar(@$whines_in_use)) {
 405             ThrowUserError('saved_search_used_by_whines',
 406                            { subjects    => join(',', @$whines_in_use),
 407                              search_name => $qname                      }
 408             );
 409         }
 410
 411         # If we are here, then we can safely remove the saved search
 412         $dbh->do("DELETE FROM namedqueries"
 413             . " WHERE userid = ? AND name = ?"
 414             , undef, ($userid, $qname));
 415
 416         # Now reset the cached queries
 417         Bugzilla->user->flush_queries_cache();
 418
 419         print $cgi->header();
 420         # Generate and return the UI (HTML page) from the appropriate template.
 421         $vars->{'message'} = "buglist_query_gone";
 422         $vars->{'namedcmd'} = $cgi->param('namedcmd');
 423         $vars->{'url'} = "query.cgi";
 424         $template->process("global/message.html.tmpl", $vars)
 425           || ThrowTemplateError($template->error());
 426         exit;
 427     }
 428 }
 429 elsif (($cgi->param('cmdtype') eq "doit") && defined $cgi->param('remtype')) {
 430     if ($cgi->param('remtype') eq "asdefault") {
 431         Bugzilla->login(LOGIN_REQUIRED);
 432         InsertNamedQuery(Bugzilla->user->id, DEFAULT_QUERY_NAME, $::buffer);
 433         $vars->{'message'} = "buglist_new_default_query";
 434     }
 435     elsif ($cgi->param('remtype') eq "asnamed") {
 436         Bugzilla->login(LOGIN_REQUIRED);
 437         my $userid = Bugzilla->user->id;
 438         my $query_name = $cgi->param('newqueryname');
 439
 440         my $tofooter = 1;
 441         my $existed_before = InsertNamedQuery($userid, $query_name,
 442                                               scalar $cgi->param('newquery'),
 443                                               $tofooter);
 444         if ($existed_before) {
 445             $vars->{'message'} = "buglist_updated_named_query";
 446         }
 447         else {
 448             $vars->{'message'} = "buglist_new_named_query";
 449         }
 450
 451         # Make sure to invalidate any cached query data, so that the footer is
 452         # correctly displayed
 453         Bugzilla->user->flush_queries_cache();
 454
 455         $vars->{'queryname'} = $query_name;
 456
 457         print $cgi->header();
 458         $template->process("global/message.html.tmpl", $vars)
 459           || ThrowTemplateError($template->error());
 460         exit;
 461     }
 462 }
 463
 464 # backward compatibility hack: if the saved query doesn't say which
 465 # form was used to create it, assume it was on the advanced query
 466 # form - see bug 252295
 467 if (!$params->param('query_format')) {
 468     $params->param('query_format', 'advanced');
 469     $::buffer = $params->query_string;
 470 }
 471
 472 ################################################################################
 473 # Column Definition
 474 ################################################################################
 475
 476 # Define the columns that can be selected in a query and/or displayed in a bug
 477 # list.  Column records include the following fields:
 478 #
 479 # 1. ID: a unique identifier by which the column is referred in code;
 480 #
 481 # 2. Name: The name of the column in the database (may also be an expression
 482 #          that returns the value of the column);
 483 #
 484 # 3. Title: The title of the column as displayed to users.
 485 #
 486 # Note: There are a few hacks in the code that deviate from these definitions.
 487 #       In particular, when the list is sorted by the "votes" field the word
 488 #       "DESC" is added to the end of the field to sort in descending order,
 489 #       and the redundant short_desc column is removed when the client
 490 #       requests "all" columns.
 491 # Note: For column names using aliasing (SQL "<field> AS <alias>"), the column
 492 #       ID needs to be identical to the field ID for list ordering to work.
 493
 494 my $columns = {};
 495 sub DefineColumn {
 496     my ($id, $name, $title) = @_;
 497     $columns->{$id} = { 'name' => $name , 'title' => $title };
 498 }
 499
 500 # Column:     ID                    Name                           Title
 501 DefineColumn("bug_id"            , "bugs.bug_id"                , "ID"               );
 502 DefineColumn("alias"             , "bugs.alias"                 , "Alias"           );
 503 DefineColumn("opendate"          , "bugs.creation_ts"           , "Opened"           );
 504 DefineColumn("changeddate"       , "bugs.delta_ts"              , "Changed"          );
 505 DefineColumn("bug_severity"      , "bugs.bug_severity"          , "Severity"         );
 506 DefineColumn("priority"          , "bugs.priority"              , "Priority"         );
 507 DefineColumn("rep_platform"      , "bugs.rep_platform"          , "Hardware"         );
 508 DefineColumn("assigned_to"       , "map_assigned_to.login_name" , "Assignee"         );
 509 DefineColumn("reporter"          , "map_reporter.login_name"    , "Reporter"         );
 510 DefineColumn("qa_contact"        , "map_qa_contact.login_name"  , "QA Contact"       );
 511 if ($format->{'extension'} eq 'html') {
 512     DefineColumn("assigned_to_realname", "CASE WHEN map_assigned_to.realname = '' THEN map_assigned_to.login_name ELSE map_assigned_to.realname END AS assigned_to_realname", "Assignee"  );
 513     DefineColumn("reporter_realname"   , "CASE WHEN map_reporter.realname    = '' THEN map_reporter.login_name    ELSE map_reporter.realname    END AS reporter_realname"   , "Reporter"  );
 514     DefineColumn("qa_contact_realname" , "CASE WHEN map_qa_contact.realname  = '' THEN map_qa_contact.login_name  ELSE map_qa_contact.realname  END AS qa_contact_realname" , "QA Contact");
 515 } else {
 516     DefineColumn("assigned_to_realname", "map_assigned_to.realname AS assigned_to_realname", "Assignee"  );
 517     DefineColumn("reporter_realname"   , "map_reporter.realname AS reporter_realname"      , "Reporter"  );
 518     DefineColumn("qa_contact_realname" , "map_qa_contact.realname AS qa_contact_realname"  , "QA Contact");
 519 }
 520 DefineColumn("bug_status"        , "bugs.bug_status"            , "Status"           );
 521 DefineColumn("resolution"        , "bugs.resolution"            , "Resolution"       );
 522 DefineColumn("short_short_desc"  , "bugs.short_desc"            , "Summary"          );
 523 DefineColumn("short_desc"        , "bugs.short_desc"            , "Summary"          );
 524 DefineColumn("status_whiteboard" , "bugs.status_whiteboard"     , "Whiteboard"       );
 525 DefineColumn("component"         , "map_components.name"        , "Component"        );
 526 DefineColumn("product"           , "map_products.name"          , "Product"          );
 527 DefineColumn("classification"    , "map_classifications.name"   , "Classification"   );
 528 DefineColumn("version"           , "bugs.version"               , "Version"          );
 529 DefineColumn("op_sys"            , "bugs.op_sys"                , "OS"               );
 530 DefineColumn("target_milestone"  , "bugs.target_milestone"      , "Target Milestone" );
 531 DefineColumn("votes"             , "bugs.votes"                 , "Votes"            );
 532 DefineColumn("keywords"          , "bugs.keywords"              , "Keywords"         );
 533 DefineColumn("estimated_time"    , "bugs.estimated_time"        , "Estimated Hours"  );
 534 DefineColumn("remaining_time"    , "bugs.remaining_time"        , "Remaining Hours"  );
 535 DefineColumn("actual_time"       , "(SUM(ldtime.work_time)*COUNT(DISTINCT ldtime.bug_when)/COUNT(bugs.bug_id)) AS actual_time", "Actual Hours");
 536 DefineColumn("percentage_complete",
 537     "(CASE WHEN (SUM(ldtime.work_time)*COUNT(DISTINCT ldtime.bug_when)/COUNT(bugs.bug_id)) " .
 538     "            + bugs.remaining_time = 0.0 " .
 539     "THEN 0.0 " .
 540     "ELSE 100*((SUM(ldtime.work_time)*COUNT(DISTINCT ldtime.bug_when)/COUNT(bugs.bug_id)) " .
 541     "     /((SUM(ldtime.work_time)*COUNT(DISTINCT ldtime.bug_when)/COUNT(bugs.bug_id)) + bugs.remaining_time)) " .
 542     "END) AS percentage_complete"                               , "% Complete");
 543 DefineColumn("relevance"         , "relevance"                  , "Relevance"        );
 544 DefineColumn("deadline"          , $dbh->sql_date_format('bugs.deadline', '%Y-%m-%d') . " AS deadline", "Deadline");
 545
 546 ################################################################################
 547 # Display Column Determination
 548 ################################################################################
 549
 550 # Determine the columns that will be displayed in the bug list via the
 551 # columnlist CGI parameter, the user's preferences, or the default.
 552 my @displaycolumns = ();
 553 if (defined $params->param('columnlist')) {
 554     if ($params->param('columnlist') eq "all") {
 555         # If the value of the CGI parameter is "all", display all columns,
 556         # but remove the redundant "short_desc" column.
 557         @displaycolumns = grep($_ ne 'short_desc', keys(%$columns));
 558     }
 559     else {
 560         @displaycolumns = split(/[ ,]+/, $params->param('columnlist'));
 561     }
 562 }
 563 elsif (defined $cgi->cookie('COLUMNLIST')) {
 564     # 2002-10-31 Rename column names (see bug 176461)
 565     my $columnlist = $cgi->cookie('COLUMNLIST');
 566     $columnlist =~ s/\bowner\b/assigned_to/;
 567     $columnlist =~ s/\bowner_realname\b/assigned_to_realname/;
 568     $columnlist =~ s/\bplatform\b/rep_platform/;
 569     $columnlist =~ s/\bseverity\b/bug_severity/;
 570     $columnlist =~ s/\bstatus\b/bug_status/;
 571     $columnlist =~ s/\bsummaryfull\b/short_desc/;
 572     $columnlist =~ s/\bsummary\b/short_short_desc/;
 573
 574     # Use the columns listed in the user's preferences.
 575     @displaycolumns = split(/ /, $columnlist);
 576 }
 577 else {
 578     # Use the default list of columns.
 579     @displaycolumns = DEFAULT_COLUMN_LIST;
 580 }
 581
 582 # Weed out columns that don't actually exist to prevent the user
 583 # from hacking their column list cookie to grab data to which they
 584 # should not have access.  Detaint the data along the way.
 585 @displaycolumns = grep($columns->{$_} && trick_taint($_), @displaycolumns);
 586
 587 # Remove the "ID" column from the list because bug IDs are always displayed
 588 # and are hard-coded into the display templates.
 589 @displaycolumns = grep($_ ne 'bug_id', @displaycolumns);
 590
 591 # Add the votes column to the list of columns to be displayed
 592 # in the bug list if the user is searching for bugs with a certain
 593 # number of votes and the votes column is not already on the list.
 594
 595 # Some versions of perl will taint 'votes' if this is done as a single
 596 # statement, because the votes param is tainted at this point
 597 my $votes = $params->param('votes');
 598 $votes ||= "";
 599 if (trim($votes) && !grep($_ eq 'votes', @displaycolumns)) {
 600     push(@displaycolumns, 'votes');
 601 }
 602
 603 # Remove the timetracking columns if they are not a part of the group
 604 # (happens if a user had access to time tracking and it was revoked/disabled)
 605 if (!UserInGroup(Param("timetrackinggroup"))) {
 606    @displaycolumns = grep($_ ne 'estimated_time', @displaycolumns);
 607    @displaycolumns = grep($_ ne 'remaining_time', @displaycolumns);
 608    @displaycolumns = grep($_ ne 'actual_time', @displaycolumns);
 609    @displaycolumns = grep($_ ne 'percentage_complete', @displaycolumns);
 610    @displaycolumns = grep($_ ne 'deadline', @displaycolumns);
 611 }
 612
 613 # Remove the relevance column if the user is not doing a fulltext search.
 614 if (grep('relevance', @displaycolumns) && !$fulltext) {
 615     @displaycolumns = grep($_ ne 'relevance', @displaycolumns);
 616 }
 617
 618
 619 ################################################################################
 620 # Select Column Determination
 621 ################################################################################
 622
 623 # Generate the list of columns that will be selected in the SQL query.
 624
 625 # The bug ID is always selected because bug IDs are always displayed.
 626 # Severity, priority, resolution and status are required for buglist
 627 # CSS classes.
 628 my @selectcolumns = ("bug_id", "bug_severity", "priority", "bug_status",
 629                      "resolution");
 630
 631 # if using classification, we also need to look in product.classification_id
 632 if (Param("useclassification")) {
 633     push (@selectcolumns,"product");
 634 }
 635
 636 # remaining and actual_time are required for precentage_complete calculation:
 637 if (lsearch(\@displaycolumns, "percentage_complete") >= 0) {
 638     push (@selectcolumns, "remaining_time");
 639     push (@selectcolumns, "actual_time");
 640 }
 641
 642 # Display columns are selected because otherwise we could not display them.
 643 push (@selectcolumns, @displaycolumns);
 644
 645 # If the user is editing multiple bugs, we also make sure to select the product
 646 # and status because the values of those fields determine what options the user
 647 # has for modifying the bugs.
 648 if ($dotweak) {
 649     push(@selectcolumns, "product") if !grep($_ eq 'product', @selectcolumns);
 650     push(@selectcolumns, "bug_status") if !grep($_ eq 'bug_status', @selectcolumns);
 651 }
 652
 653 if ($format->{'extension'} eq 'ics') {
 654     push(@selectcolumns, "opendate") if !grep($_ eq 'opendate', @selectcolumns);
 655 }
 656
 657 if ($format->{'extension'} eq 'atom') {
 658     # This is the list of fields that are needed by the Atom filter.
 659     my @required_atom_columns = (
 660       'short_desc',
 661       'opendate',
 662       'changeddate',
 663       'reporter_realname',
 664       'priority',
 665       'bug_severity',
 666       'assigned_to_realname',
 667       'bug_status'
 668     );
 669
 670     foreach my $required (@required_atom_columns) {
 671         push(@selectcolumns, $required) if !grep($_ eq $required,@selectcolumns);
 672     }
 673 }
 674
 675 ################################################################################
 676 # Query Generation
 677 ################################################################################
 678
 679 # Convert the list of columns being selected into a list of column names.
 680 my @selectnames = map($columns->{$_}->{'name'}, @selectcolumns);
 681
 682 # Remove columns with no names, such as percentage_complete
 683 #  (or a removed *_time column due to permissions)
 684 @selectnames = grep($_ ne '', @selectnames);
 685
 686 ################################################################################
 687 # Sort Order Determination
 688 ################################################################################
 689
 690 # Add to the query some instructions for sorting the bug list.
 691
 692 # First check if we'll want to reuse the last sorting order; that happens if
 693 # the order is not defined or its value is "reuse last sort"
 694 if (!$order || $order =~ /^reuse/i) {
 695     if ($cgi->cookie('LASTORDER')) {
 696         $order = $cgi->cookie('LASTORDER');
 697
 698         # Cookies from early versions of Specific Search included this text,
 699         # which is now invalid.
 700         $order =~ s/ LIMIT 200//;
 701
 702         $order_from_cookie = 1;
 703     }
 704     else {
 705         $order = '';  # Remove possible "reuse" identifier as unnecessary
 706     }
 707 }
 708
 709 my $db_order = "";  # Modified version of $order for use with SQL query
 710 if ($order) {
 711     # Convert the value of the "order" form field into a list of columns
 712     # by which to sort the results.
 713     ORDER: for ($order) {
 714         /^Bug Number$/ && do {
 715             $order = "bugs.bug_id";
 716             last ORDER;
 717         };
 718         /^Importance$/ && do {
 719             $order = "bugs.priority, bugs.bug_severity";
 720             last ORDER;
 721         };
 722         /^Assignee$/ && do {
 723             $order = "map_assigned_to.login_name, bugs.bug_status, bugs.priority, bugs.bug_id";
 724             last ORDER;
 725         };
 726         /^Last Changed$/ && do {
 727             $order = "bugs.delta_ts, bugs.bug_status, bugs.priority, map_assigned_to.login_name, bugs.bug_id";
 728             last ORDER;
 729         };
 730         do {
 731             my @order;
 732             my @columnnames = map($columns->{lc($_)}->{'name'}, keys(%$columns));
 733             # A custom list of columns.  Make sure each column is valid.
 734             foreach my $fragment (split(/,/, $order)) {
 735                 $fragment = trim($fragment);
 736                 # Accept an order fragment matching a column name, with
 737                 # asc|desc optionally following (to specify the direction)
 738                 if (grep($fragment =~ /^\Q$_\E(\s+(asc|desc))?$/, @columnnames, keys(%$columns))) {
 739                     next if $fragment =~ /\brelevance\b/ && !$fulltext;
 740                     push(@order, $fragment);
 741                 }
 742                 else {
 743                     my $vars = { fragment => $fragment };
 744                     if ($order_from_cookie) {
 745                         $cgi->remove_cookie('LASTORDER');
 746                         ThrowCodeError("invalid_column_name_cookie", $vars);
 747                     }
 748                     else {
 749                         ThrowCodeError("invalid_column_name_form", $vars);
 750                     }
 751                 }
 752             }
 753             $order = join(",", @order);
 754             # Now that we have checked that all columns in the order are valid,
 755             # detaint the order string.
 756             trick_taint($order);
 757         };
 758     }
 759 }
 760 else {
 761     # DEFAULT
 762     $order = "bugs.bug_status, bugs.priority, map_assigned_to.login_name, bugs.bug_id";
 763 }
 764
 765 # Make sure ORDER BY columns are included in the field list.
 766 foreach my $fragment (split(/,/, $order)) {
 767     $fragment = trim($fragment);
 768     if (!grep($fragment =~ /^\Q$_\E(\s+(asc|desc))?$/, @selectnames)) {
 769         # Add order columns to selectnames
 770         # The fragment has already been validated
 771         $fragment =~ s/\s+(asc|desc)$//;
 772
 773         # While newer fragments contain IDs for aliased columns, older
 774         # LASTORDER cookies (or bookmarks) may contain full names.
 775         # Convert them to an ID here.
 776         if ($fragment =~ / AS (\w+)/) {
 777             $fragment = $columns->{$1}->{'id'};
 778         }
 779
 780         $fragment =~ tr/a-zA-Z\.0-9\-_//cd;
 781
 782         # If the order fragment is an ID, we need its corresponding name
 783         # to be in the field list.
 784         if (exists($columns->{$fragment})) {
 785             $fragment = $columns->{$fragment}->{'name'};
 786         }
 787
 788         push @selectnames, $fragment;
 789     }
 790 }
 791
 792 $db_order = $order;  # Copy $order into $db_order for use with SQL query
 793
 794 # If we are sorting by votes, sort in descending order if no explicit
 795 # sort order was given
 796 $db_order =~ s/bugs.votes\s*(,|$)/bugs.votes desc$1/i;
 797
 798 # the 'actual_time' field is defined as an aggregate function, but
 799 # for order we just need the column name 'actual_time'
 800 my $aggregate_search = quotemeta($columns->{'actual_time'}->{'name'});
 801 $db_order =~ s/$aggregate_search/actual_time/g;
 802
 803 # the 'percentage_complete' field is defined as an aggregate too
 804 $aggregate_search = quotemeta($columns->{'percentage_complete'}->{'name'});
 805 $db_order =~ s/$aggregate_search/percentage_complete/g;
 806
 807 # Now put $db_order into a format that Bugzilla::Search can use.
 808 # (We create $db_order as a string first because that's the way
 809 # we did it before Bugzilla::Search took an "order" argument.)
 810 my @orderstrings = split(',', $db_order);
 811
 812 # Generate the basic SQL query that will be used to generate the bug list.
 813 my $search = new Bugzilla::Search('fields' => \@selectnames,
 814                                   'params' => $params,
 815                                   'order' => \@orderstrings);
 816 my $query = $search->getSQL();
 817
 818 if (defined $cgi->param('limit')) {
 819     my $limit = $cgi->param('limit');
 820     if (detaint_natural($limit)) {
 821         $query .= " " . $dbh->sql_limit($limit);
 822     }
 823 }
 824 elsif ($fulltext) {
 825     $query .= " " . $dbh->sql_limit(FULLTEXT_BUGLIST_LIMIT);
 826     $vars->{'sorted_by_relevance'} = 1;
 827 }
 828
 829
 830 ################################################################################
 831 # Query Execution
 832 ################################################################################
 833
 834 if ($cgi->param('debug')) {
 835     $vars->{'debug'} = 1;
 836     $vars->{'query'} = $query;
 837 }
 838
 839 # Time to use server push to display an interim message to the user until
 840 # the query completes and we can display the bug list.
 841 my $disposition = '';
 842 if ($serverpush) {
 843     $filename =~ s/\\/\\\\/g; # escape backslashes
 844     $filename =~ s/"/\\"/g; # escape quotes
 845     $disposition = qq#inline; filename="$filename"#;
 846
 847     print $cgi->multipart_init(-content_disposition => $disposition);
 848     print $cgi->multipart_start();
 849
 850     # Generate and return the UI (HTML page) from the appropriate template.
 851     $template->process("list/server-push.html.tmpl", $vars)
 852       || ThrowTemplateError($template->error());
 853
 854     # Don't do multipart_end() until we're ready to display the replacement
 855     # page, otherwise any errors that happen before then (like SQL errors)
 856     # will result in a blank page being shown to the user instead of the error.
 857 }
 858
 859 # Connect to the shadow database if this installation is using one to improve
 860 # query performance.
 861 $dbh = Bugzilla->switch_to_shadow_db();
 862
 863 # Normally, we ignore SIGTERM and SIGPIPE (see globals.pl) but we need to
 864 # respond to them here to prevent someone DOSing us by reloading a query
 865 # a large number of times.
 866 $::SIG{TERM} = 'DEFAULT';
 867 $::SIG{PIPE} = 'DEFAULT';
 868
 869 # Execute the query.
 870 my $buglist_sth = $dbh->prepare($query);
 871 $buglist_sth->execute();
 872
 873
 874 ################################################################################
 875 # Results Retrieval
 876 ################################################################################
 877
 878 # Retrieve the query results one row at a time and write the data into a list
 879 # of Perl records.
 880
 881 my $bugowners = {};
 882 my $bugproducts = {};
 883 my $bugstatuses = {};
 884 my @bugidlist;
 885
 886 my @bugs; # the list of records
 887
 888 while (my @row = $buglist_sth->fetchrow_array()) {
 889     my $bug = {}; # a record
 890
 891     # Slurp the row of data into the record.
 892     # The second from last column in the record is the number of groups
 893     # to which the bug is restricted.
 894     foreach my $column (@selectcolumns) {
 895         $bug->{$column} = shift @row;
 896     }
 897
 898     # Process certain values further (i.e. date format conversion).
 899     if ($bug->{'changeddate'}) {
 900         $bug->{'changeddate'} =~
 901             s/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})$/$1-$2-$3 $4:$5:$6/;
 902
 903         # Put in the change date as a time, so that the template date plugin
 904         # can format the date in any way needed by the template. ICS and Atom
 905         # have specific, and different, date and time formatting.
 906         $bug->{'changedtime'} = str2time($bug->{'changeddate'});
 907         $bug->{'changeddate'} = DiffDate($bug->{'changeddate'});
 908     }
 909
 910     if ($bug->{'opendate'}) {
 911         # Put in the open date as a time for the template date plugin.
 912         $bug->{'opentime'} = str2time($bug->{'opendate'});
 913         $bug->{'opendate'} = DiffDate($bug->{'opendate'});
 914     }
 915
 916     # Record the assignee, product, and status in the big hashes of those things.
 917     $bugowners->{$bug->{'assigned_to'}} = 1 if $bug->{'assigned_to'};
 918     $bugproducts->{$bug->{'product'}} = 1 if $bug->{'product'};
 919     $bugstatuses->{$bug->{'bug_status'}} = 1 if $bug->{'bug_status'};
 920
 921     $bug->{'secure_mode'} = undef;
 922
 923     # Add the record to the list.
 924     push(@bugs, $bug);
 925
 926     # Add id to list for checking for bug privacy later
 927     push(@bugidlist, $bug->{'bug_id'});
 928 }
 929
 930 # Check for bug privacy and set $bug->{'secure_mode'} to 'implied' or 'manual'
 931 # based on whether the privacy is simply product implied (by mandatory groups)
 932 # or because of human choice
 933 my %min_membercontrol;
 934 if (@bugidlist) {
 935     my $sth = $dbh->prepare(
 936         "SELECT DISTINCT bugs.bug_id, MIN(group_control_map.membercontrol) " .
 937           "FROM bugs " .
 938     "INNER JOIN bug_group_map " .
 939             "ON bugs.bug_id = bug_group_map.bug_id " .
 940      "LEFT JOIN group_control_map " .
 941             "ON group_control_map.product_id = bugs.product_id " .
 942            "AND group_control_map.group_id = bug_group_map.group_id " .
 943          "WHERE bugs.bug_id IN (" . join(',',@bugidlist) . ") " .
 944             $dbh->sql_group_by('bugs.bug_id'));
 945     $sth->execute();
 946     while (my ($bug_id, $min_membercontrol) = $sth->fetchrow_array()) {
 947         $min_membercontrol{$bug_id} = $min_membercontrol || CONTROLMAPNA;
 948     }
 949     foreach my $bug (@bugs) {
 950         next unless defined($min_membercontrol{$bug->{'bug_id'}});
 951         if ($min_membercontrol{$bug->{'bug_id'}} == CONTROLMAPMANDATORY) {
 952             $bug->{'secure_mode'} = 'implied';
 953         }
 954         else {
 955             $bug->{'secure_mode'} = 'manual';
 956         }
 957     }
 958 }
 959
 960 ################################################################################
 961 # Template Variable Definition
 962 ################################################################################
 963
 964 # Define the variables and functions that will be passed to the UI template.
 965
 966 $vars->{'bugs'} = \@bugs;
 967 $vars->{'buglist'} = \@bugidlist;
 968 $vars->{'buglist_joined'} = join(',', @bugidlist);
 969 $vars->{'columns'} = $columns;
 970 $vars->{'displaycolumns'} = \@displaycolumns;
 971
 972 my @openstates = OpenStates();
 973 $vars->{'openstates'} = \@openstates;
 974 $vars->{'closedstates'} = ['CLOSED', 'VERIFIED', 'RESOLVED'];
 975
 976 # The list of query fields in URL query string format, used when creating
 977 # URLs to the same query results page with different parameters (such as
 978 # a different sort order or when taking some action on the set of query
 979 # results).  To get this string, we start with the raw URL query string
 980 # buffer that was created when we initially parsed the URL on script startup,
 981 # then we remove all non-query fields from it, f.e. the sort order (order)
 982 # and command type (cmdtype) fields.
 983 $vars->{'urlquerypart'} = $::buffer;
 984 $vars->{'urlquerypart'} =~ s/(order|cmdtype)=[^&]*&?//g;
 985 $vars->{'order'} = $order;
 986 $vars->{'caneditbugs'} = UserInGroup('editbugs');
 987
 988 my @bugowners = keys %$bugowners;
 989 if (scalar(@bugowners) > 1 && UserInGroup('editbugs')) {
 990     my $suffix = Param('emailsuffix');
 991     map(s/$/$suffix/, @bugowners) if $suffix;
 992     my $bugowners = join(",", @bugowners);
 993     $vars->{'bugowners'} = $bugowners;
 994 }
 995
 996 # Whether or not to split the column titles across two rows to make
 997 # the list more compact.
 998 $vars->{'splitheader'} = $cgi->cookie('SPLITHEADER') ? 1 : 0;
 999
1000 $vars->{'quip'} = GetQuip();
1001 $vars->{'currenttime'} = time();
1002
1003 # The following variables are used when the user is making changes to multiple bugs.
1004 if ($dotweak) {
1005     $vars->{'dotweak'} = 1;
1006     $vars->{'use_keywords'} = 1 if @::legal_keywords;
1007
1008     my @enterable_products = GetEnterableProducts();
1009     $vars->{'products'} = \@enterable_products;
1010     $vars->{'platforms'} = \@::legal_platform;
1011     $vars->{'priorities'} = \@::legal_priority;
1012     $vars->{'severities'} = \@::legal_severity;
1013     $vars->{'resolutions'} = \@::settable_resolution;
1014
1015     $vars->{'unconfirmedstate'} = 'UNCONFIRMED';
1016
1017     $vars->{'bugstatuses'} = [ keys %$bugstatuses ];
1018
1019     # The groups to which the user belongs.
1020     $vars->{'groups'} = GetGroupsByUserId($::userid);
1021
1022     # If all bugs being changed are in the same product, the user can change
1023     # their version and component, so generate a list of products, a list of
1024     # versions for the product (if there is only one product on the list of
1025     # products), and a list of components for the product.
1026     $vars->{'bugproducts'} = [ keys %$bugproducts ];
1027     if (scalar(@{$vars->{'bugproducts'}}) == 1) {
1028         my $product = $vars->{'bugproducts'}->[0];
1029         $vars->{'versions'} = $::versions{$product};
1030         $vars->{'components'} = $::components{$product};
1031         $vars->{'targetmilestones'} = $::target_milestone{$product} if Param('usetargetmilestone');
1032     }
1033 }
1034
1035 # If we're editing a stored query, use the existing query name as default for
1036 # the "Remember search as" field.
1037 $vars->{'defaultsavename'} = $cgi->param('query_based_on');
1038
1039
1040 ################################################################################
1041 # HTTP Header Generation
1042 ################################################################################
1043
1044 # Generate HTTP headers
1045
1046 my $contenttype;
1047 my $disp = "inline";
1048
1049 if ($format->{'extension'} eq "html") {
1050     if ($order) {
1051         $cgi->send_cookie(-name => 'LASTORDER',
1052                           -value => $order,
1053                           -expires => 'Fri, 01-Jan-2038 00:00:00 GMT');
1054     }
1055     my $bugids = join(":", @bugidlist);
1056     # See also Bug 111999
1057     if (length($bugids) == 0) {
1058         $cgi->remove_cookie('BUGLIST');
1059     }
1060     elsif (length($bugids) < 4000) {
1061         $cgi->send_cookie(-name => 'BUGLIST',
1062                           -value => $bugids,
1063                           -expires => 'Fri, 01-Jan-2038 00:00:00 GMT');
1064     }
1065     else {
1066         $cgi->remove_cookie('BUGLIST');
1067         $vars->{'toolong'} = 1;
1068     }
1069
1070     $contenttype = "text/html";
1071 }
1072 else {
1073     $contenttype = $format->{'ctype'};
1074 }
1075
1076 if ($format->{'extension'} eq "csv") {
1077     # We set CSV files to be downloaded, as they are designed for importing
1078     # into other programs.
1079     $disp = "attachment";
1080 }
1081
1082 if ($serverpush) {
1083     # close the "please wait" page, then open the buglist page
1084     print $cgi->multipart_end();
1085     print $cgi->multipart_start(-type => $contenttype, -content_disposition => $disposition);
1086 } else {
1087     # Suggest a name for the bug list if the user wants to save it as a file.
1088     # If we are doing server push, then we did this already in the HTTP headers
1089     # that started the server push, so we don't have to do it again here.
1090     print $cgi->header(-type => $contenttype,
1091                        -content_disposition => "$disp; filename=$filename");
1092 }
1093
1094
1095 ################################################################################
1096 # Content Generation
1097 ################################################################################
1098
1099 # Generate and return the UI (HTML page) from the appropriate template.
1100 $template->process($format->{'template'}, $vars)
1101   || ThrowTemplateError($template->error());
1102
1103
1104 ################################################################################
1105 # Script Conclusion
1106 ################################################################################
1107
1108 print $cgi->multipart_final() if $serverpush;