Issue with "view" access control

[Yves Martin]

 Hello,

I have troubles with my GNATS databases since I have upgraded from gnats
4.0 to gnats 4.1 (Debian Etch system) using gnatsweb as front-end

Since upgrade, a user with "view" access right always receive:
  server_reply: 220 No PRs match.
Whereas a user with "edit" or "viewconf" access right gets 52
non-confidential issues.

I have re-generated index for this database but without any positive
change.

What should I do to get it work again properly ?
Thank you in advance for your help
--
Yves Martin


_______________________________________________
Help-gnats mailing list
Help-gnats@...
http://lists.gnu.org/mailman/listinfo/help-gnats

[Yves Martin]

On Thu, 2007-09-13 at 10:17 +0200, Yves Martin wrote:
> Hello,
>
> I have troubles with my GNATS databases since I have upgraded from gnats
> 4.0 to gnats 4.1 (Debian Etch system) using gnatsweb as front-end
>
> Since upgrade, a user with "view" access right always receive:
>   server_reply: 220 No PRs match.
> Whereas a user with "edit" or "viewconf" access right gets 52
> non-confidential issues.

Finally, I have found a bug after a debug party with a colleague in the
method:

--- cmds.c.orig 2007-09-13 15:57:05.000000000 +0200
+++ cmds.c      2007-09-13 15:57:15.000000000 +0200
@@ -365,7 +365,7 @@
     {
       QueryExpr newQ
        = parseQueryExpression (currentDatabase,
-                               "builtinfield:Confidential ~ \"no\"",
+                               "builtinfield:Confidential~\"no\"",
                                NULL);
       *search = booleanQuery (QueryAnd, *search, newQ);
     }

The current expression does not work properly with gnats 4.1 - does it
come from a bug in Etch versions of lex or bison-1.35 ?

More investigation is necessary I think.
Regards
--
Yves Martin


_______________________________________________
Help-gnats mailing list
Help-gnats@...
http://lists.gnu.org/mailman/listinfo/help-gnats

[Chad Walstrom-4]

Thank you for the bug report and update.  The instance of GNATS on my
workstation has been down since I switched distros from Debian to
Gentoo, and I haven't had time to bring it back on-line.  I'll work on
that this weekend.

In any case, I'll commit the fix to CVS tonight.  Also in the works is
updating all of the copyright licenses to GPL/LGPL v3. I did a cursory
license "audit" on the copyrighted code.  The only thing I could come up
with as being non-GPLv2 is the MIT Kerberos 4 code.  The copyright
notice (a header file) was missing, so I re-added one from a similar
project on-line.  The kerberos code seems to be a bit broken now, and
doesn't compile correctly anyway -- my attempt at an acinclude.m4 file
to account for this old code has some obvious flaws.  I'll make another
attempt at debugging the build code, but I'll make no promises.  We
really should think about replacing it with the GNU gssapi stuff anyway.

All of our other files had copyright headers stating GPLv2, so I've
updated those and committed the changes to CVS.  We should be talking
release Real Soon Now (TM) for 4.2, which I don't think the broken
kerberos build should block.  I know I've been saying this for a while
now, but with the GPL upgrade, it's time.

There is a submitted patch I will be rolling in for serializing the
email submission queue, rather than using random tempfile names.  If
anyone else has CVS commit access and wants to get something rolled in
before the release, now is the time to do it.  I will making a CVS
snapshot tarball this Sunday, 16 September, and uploading it to alpha.

Thanks for your hard work and patience!

Chad


_______________________________________________
Help-gnats mailing list
Help-gnats@...
http://lists.gnu.org/mailman/listinfo/help-gnats

[Chad Walstrom]

Regarding the patch to the "view" access control, where you've removed
the whitespace from the expression as the fix.  I'm not so comfortable
with that particular patch, as it doesn't really demonstrate WHY
whitespace is causing the expression to fail.  I've only had a moment to
trace the calls, but I'll take more time on it this weekend.  I don't
mind offering patches to fix the "symptoms" as a hot-fix, but we should
really find the cause for this failure.  It is obviously not intended to
work this way.

Thanks again for bringing it to our attention.

Chad


_______________________________________________
Help-gnats mailing list
Help-gnats@...
http://lists.gnu.org/mailman/listinfo/help-gnats

[Yves Martin]

On Fri, 2007-09-14 at 09:59 -0500, Chad Walstrom wrote:
> Regarding the patch to the "view" access control, where you've removed
> the whitespace from the expression as the fix.  I'm not so comfortable
> with that particular patch, as it doesn't really demonstrate WHY
> whitespace is causing the expression to fail.  I've only had a moment to
> trace the calls, but I'll take more time on it this weekend.  I don't
> mind offering patches to fix the "symptoms" as a hot-fix, but we should
> really find the cause for this failure.  It is obviously not intended to
> work this way.

I really agree with you... that's why I have said there is more
investigation to lead.
By the way, I have submitted the patch to help point the issue and quick
fix productive environment like mine.

In fact, there is no change between gnats 4.0 and 4.1 that may explain
this expression parsing issue.

I guess Bison 1.35 is in trouble in that case. Maybe a compilation on
another system than Debian Etch will work perfectly.

Regards,
--
Yves Martin



_______________________________________________
Help-gnats mailing list
Help-gnats@...
http://lists.gnu.org/mailman/listinfo/help-gnats

[Chad Walstrom]

The only thing regarding this error is that I do not believe bison is
involved in any way shape or form.  As far as I can see, the only thing
bison/yacc is used for is date parsing and parsing of the dbconfig file.
All of the expression parsing is done via a hand-rolled tokenizer.  My
gut feeling from Friday's quick code review is that perhaps the
expression in cmds.c had called the wrong function in the chain
responsible for parsing the expressions.  It made a short-cut that
didn't consume the spaces.  Why this would work in 4.0 and not 4.1 is
beyond me.

I'm hoping to carve out some time tomorrow morning/afternoon to look at
this more closely and roll an alpha tarball.  I'll keep you posted as to
what I find.

Chad


_______________________________________________
Help-gnats mailing list
Help-gnats@...
http://lists.gnu.org/mailman/listinfo/help-gnats