Commit Graph

405 Commits

Author SHA1 Message Date
Nikita Popov
bc9db6eacf Make spam filter stricter again 2023-07-09 09:21:21 +02:00
Nikita Popov
717f16a6d9 Make spam filter stricter
Require that php.net/github.com is in the host portion.
2023-06-24 21:19:47 +02:00
Nikita Popov
7d1c27f5fb Add ilutov as trusted dev 2022-03-27 22:12:15 +02:00
Nikita Popov
d50077c254 Only allow links to php.net and github.com
Activity on bugs.php.net is pretty much down to link spam now.
Fight it by only allowing php.net and github.com links.
2022-03-05 18:16:40 +01:00
Christoph M. Becker
2255979dc8 Try to prevent further SPAM by them 2022-02-15 12:56:09 +01:00
Nikita Popov
d0b0481c1c Point people to the new issue tracker 2021-12-04 17:05:05 +01:00
Nikita Popov
4efb5c3428 Disable submission of "Documentation Problem" bugs
Instead point people to the php/doc-en repository.

It's still possible to change the bug type to "Documentation
Problem" after it has been submitted, e.g. if it turns out a bug
is really a documentation issue.
2021-10-28 21:10:04 +02:00
peterdd
010107def9 clickable labels for radio and checkboxes in bug search form (#96)
* usability: make label clickable for  radio input

* set a right padding for the label

so it is obvious the label is for the left side radio select.

* clickable labels for asc/desc radio select

* right padding also for the asc/desc labels

* make the "NOT" checkbox labels clickable
2021-10-21 14:16:19 +02:00
peterdd
2edddded73 Check if params for reporting a bug are is_string()
Closes GH-104.
2021-10-21 11:19:54 +02:00
Stanislav Malyshev
5853f7850c Add Stas to trusted dev list to clean up spam 2021-10-17 20:46:49 -07:00
Nikita Popov
fcfdfef2ca Add tvfun to spam list 2021-10-07 15:52:54 +02:00
peterdd
90f86d6ab9 add css classes to status select in search form (#106)
Reuses the existing CSS classes to apply the same backgorund colors as in the bug search result table rows.

I know that Chrome and Safari ignore applying a background-color to option tags of a single select. But when bugs.php.net supports also multiselect for the status select both will show the background-color in multi selects (multiple="multiple" attribute for xhtml compatible modus)
2021-10-06 12:31:50 -07:00
Sara Golemon
2f06b4d7bb Add X-Frame-Options: SAMEORIGIN 2021-09-27 14:42:13 +00:00
Christoph M. Becker
7febedd645 Add Kamil Tekiela as trusted dev
Closes GH-89.
2021-09-17 13:16:18 +02:00
Nikita Popov
4bc692453d Add lildurk to spam list 2021-09-01 20:24:12 +02:00
Peter Cowburn
3bccfcba4f add mikemike as trusted dev 2021-09-01 10:27:56 +01:00
Nikita Popov
f259231094 Count https:// URLs towards spam 2021-08-26 14:22:04 +02:00
Rasmus Lerdorf
4f2b72f626 master->main 2021-04-05 21:58:19 -07:00
Nikita Popov
860d1552b5 Add aarinkaur to spam list
Large number of spam comments posted today.
2021-03-15 09:48:24 +01:00
Christoph M. Becker
1795030d73 Add Pieter Hordijk as trusted dev 2021-01-20 15:10:46 +01:00
Peter Cowburn
997f010b1f another spam word 2021-01-04 11:33:01 +00:00
Kevin Reinders
2e6915b67d Fix #80550: bug search: Nonsensical "the following words were ignored:" w/ trailing space
We `trim()` that input.

Closes GH-88.
2020-12-28 14:33:04 +01:00
Derick Rethans
a7c206cc24 Oh please do fork off 2020-08-05 17:55:31 +01:00
Derick Rethans
ceb990c913 Still not learning 2020-07-20 10:23:22 +01:00
Nikita Popov
f27ce31a93 Add helpdeskaustralia to spam list 2020-07-06 15:16:54 +02:00
Derick Rethans
b1edeff157 They're not learning 2020-06-11 17:09:06 +01:00
Christoph M. Becker
0110b485de Add salathe as trusted dev for moderation purposes 2019-12-19 10:56:04 +01:00
Christoph M. Becker
44eaf4f6d3 Add bukka to security devs list 2019-10-20 16:25:13 +02:00
Christoph M. Becker
257c114b05 Fix #78558: Information Exposure Through an Error Message
We certainly should not display these details to anybody.  It would
make sense to show that during development, and maybe to developers.
2019-09-18 13:26:20 +02:00
Rasmus Lerdorf
ce9c82af40 Check for passed in arrays 2019-09-18 13:11:38 +02:00
Nikita Popov
0ed3f812f8 Add phpbugreports to spam mail list
Same as rhsoft.
2019-09-06 09:35:26 +02:00
Christoph M. Becker
3f2d15d380 Add myself to trusted devs for moderation purposes 2019-09-02 16:43:19 +02:00
Derick Rethans
f2df1a664b Two can play that game 2019-06-01 00:59:55 +02:00
Derick Rethans
def044bbda stop spammy users 2019-05-28 13:18:28 +01:00
Peter Kokot
95cdd55d51 Remove unused functions
- admin_table_static
- admin_table_dynamic
- inline_content_menu
2019-05-23 03:00:42 +02:00
Peter Kokot
49dd23a4a8 Move backtrace pages to templates 2019-05-22 04:43:45 +02:00
Peter Kokot
9d47b05f2d Convert all tabs to spaces 2019-05-22 02:41:51 +02:00
Peter Kokot
80d03e3e78 Move simple pages to templates
This is initial patch of the series of patches that moves the most
simple pages to templates.
2019-05-22 02:24:29 +02:00
Peter Kokot
35463d9fa3 Fix #77971: Can't access other than 1st page of advanced bug search 2019-05-05 05:42:22 +02:00
Peter Cowburn
408f4f0854 add new word to spam list 2019-03-05 19:30:46 +00:00
Peter Kokot
5cd2630a86 Add dependency injection container
This patch introduces a dependency injection container for the PHP bug
tracker application. Container deals with the creation of all service
classes and additionally provides retrieving of configuration parameters.
Service classes are used everywhere in the app - from accessing database
to uploading files. Configuration parameters include infrastructure
configuration (database credentials...) and application level
configuration (directories locations...).

Container is compatible with the PSR-11 container interface defined
so it is simple to quickly understand its usage. Advanced features
such as autowiring are not included in this phase.
2019-01-28 00:47:18 +01:00
Peter Kokot
e3c4b0ace3 Replace deprecated Text_Diff PEAR package with Horde Text_Diff
This patch replaces obsolete Text_Diff PEAR package with newer and still
maintained Horde Text_Diff version 2.2.0 as suggested in the packages
descriptions.

Since bugs.php.net production is not ready for Composer installations yet,
the Text_Diff package is bundled in the Git repository directly. Its
classes are not compliant with PSR-4 yet so the classmap has been used
until future PSR-4 migration and refactorings.
2019-01-23 22:23:09 +01:00
Peter Kokot
ae57162e8d Refactor fetching versions
- Procedural code moved to OOP
- Added unit tests
- Added a more flexible tmp folder location and introduce var folder
  (in production this won't work yet, so we still use /tmp there).
  For local development environments var directory in project root
  is used for faster and easier project setup.
- Added initial extensible PSR-16-alike semi-compatible cache class
  and refactored storing fetched versions.
- The versions list generator is now simpler and a bit more logical
  what is happening. Versions sort order is the same as before.
- Added ComposerScripts utility/service class for creating required
  directories (uploads and var/cache), and configuration file, when
  installing application in development environment.
2019-01-07 03:20:57 +01:00
Peter Kokot
068d8514af Add template engine
This patch adds an initial simplistic template engine to separate logic
from the presentation.

Basic initial features:
- escaping via Context::noHtml() and Context::e() methods
- blocks
- nesting options using includes and extending layouts
- PHP syntax
- variable scopes dedicated to template scope only
- Appending blocks (when JS files are in need to be appended)
- initial unit and functional tests
- Main index page refactored as an example of usage
- Very short intro docs how to use the template layer
- Thanks to @nhlm for the code review and numerous suggestions to
  improve the usability and code stability,
- Thanks to @KalleZ and for the code review and numerous common sense
  suggestions about templates themselves.
- Thanks to @Maikuolan for the code review and numerous suggestions
  about the usability.
- Moved hash ids redirection to aseparate JavaScript file
- Use location instead of window.location in the JavaScript redirection

Discussions:
- http://news.php.net/php.webmaster/27603
- https://github.com/php/web-bugs/pull/66
2019-01-02 22:20:11 +01:00
Peter Kokot
1c04d30518 Remove display_bug_success() function
The display_bug_success() is a simple wrapper around the echo and has
HTML embedded in it.
2018-12-19 03:44:09 +01:00
Peter Kokot
10b0ad9cbe Refactor bugs_get_bug() to repository 2018-12-17 23:46:01 +01:00
Peter Kokot
a5b6fa0704 Refactor get_resolve_reasons() to repository class 2018-12-17 23:25:17 +01:00
Peter Kokot
357ba9e051 Move fetching bug comments to a repository class
Changes:
- This moves fetching bug comments to a dedicated repository class
- It uses vanilla PDO as current direction of the database usage
  is applied in this app.
- When bug_id is set to preview types issues occur due to int type
  hint. Should be refactored more in the future commits.
2018-12-17 23:18:48 +01:00
Peter Kokot
14f8c07aec Refactor PDO wrapper
Some considerations were raised on the mailing list that this PHP
application doesn't need a PDO wrapper at all.

Changes:
- ::fetchRow() method removed in favor of the vanilla PDOStatement::fetch()
- ::fetchAll() override removed in favor of the vanilla
  PDOStatement::fetchAll()
- ::fetchCol() removed since it is not used and is only a wrapper for
  the PDOStatement::fetchColumn()
- PDO fetch_style synced accross the app. When no fetch style is passed
  the default PDO::FETCH_ASSOC is used as set when connecting to db.
- Remove Database::escape() method
  The custom ::escape() method is a wrapper around PDO::quote() which
  additionally trims leading and trailing quotes from the string. All
  this should ideally be done via prepared statements only, except where
  we can and need to use PDO::quote() this step can be done on the given
  string or variable at hand directly.
- Remove escapeSQL() function
  The escapeSQL function is a wrapper around the PDO::quote() and is
  using $dbh from the global scope which is not testable nor good practice
  further on. Removed and refactored into only PDO::quote() usages on
  required places.
- Remove ::fetchOne() method
  The fetchOne() method is a simple wrapper around the PDOStatement::fetch()
  method with very minor tweaks so the usage can be simplified even more.
  The PDOStatement::fetch(\PDO::FETCH_NUM)[0] will always return either a
  result from the database column or when row is empty a null.
- Probably this should be refactored to the database tables respected
  repositories further on.
- Remove PDO wrapper
  The app's current goal is to lean on a vanilla PDO wrapper only.
  Current set of features also don't require additional functionality
  and extending PDO to a wrapper or create a database abstraction layer
  yet.
2018-12-17 22:46:55 +01:00
Kalle Sommer Nielsen
8d01322dbf WS 2018-12-15 22:22:54 +01:00