The BS is now UP

And yet another security release:

Advisory at:
http://www.bugzilla.org/security/4.0.4/


Submitted Bugzilla 4.0.5

Hardware: i586 => All
Assignee: bugsquad => qa-bugs

Testing complete on i586 for the srpm
bugzilla-4.0.5-1.1.mga1.src.rpm

As no malicious html sample code has been provided by the
advisory, just testing that creating a new bug etc works.

CC: (none) => davidwhodgins

x86_64

Created bugs and attachments, done searches and all seems OK except when I click on reports/old charts..

Bugzilla has suffered an internal error. Please save this page and send it to with details of what you were doing at the time this message appeared.

URL: http://mega/bugzilla/reports.cgi
Unable to open the chart datafile /var/lib/bugzilla/mining/-All-.

Traceback:

 at /usr/share/bugzilla/www/reports.cgi line 151
	main::get_data(...) called at /usr/share/bugzilla/www/reports.cgi line 78

This package would benefit from a readme.urpmi with some installation instructions.

# ls /var/lib/bugzilla/mining/

Shows it is an empty directory.

A bit of a google later..

# /usr/share/bugzilla/bin/collectstats.pl

problem solved.

Olav do you want to add a readme.urpmi before this is validated?

I notice there is a readme and a readme.mdv but neither display on installation.

I renamed the README.mdv to README.urpmi and changed "Mandriva" to "Mageia".

Submitted a new version:
  bugzilla-4.0.5-1.2.mga1

Could you check if ok?

(In reply to comment #9)
> I renamed the README.mdv to README.urpmi and changed "Mandriva" to "Mageia".
> 
> Submitted a new version:
>   bugzilla-4.0.5-1.2.mga1
> 
> Could you check if ok?

Just did an uninstall/reinstall, and the README.urpmi does display
install, and I confirmed it still works.

Could someone from the sysadmin team push the srpm
bugzilla-4.0.5-1.2.mga1.src.rpm
from Core Updates Testing to Core Updates.

Advisory: This security update for bugzilla corrects
CVE-2012-0448, Account Impersonation due to email addresses containing non-ASCII
 characters
CVE-2012-0440, a Cross-Site Request Forgery vulnerability in jsonrpc.cgi
CVE-2012-0453, a Cross-Site Request Forgery vulnerability in xmlrpc.cgi

References:http://www.bugzilla.org/security/3.4.13/ 
           http://www.bugzilla.org/security/4.0.4/

https://bugs.mageia.org/show_bug.cgi?id=4374

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

update pushed

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED