Re: pearweb, HTML changelogs, moving forward

Hi,

Can you explain what you mean by my changelog implementation? I don't recall any changes to it that haven't been released already.

- Helgi

On 18 Dec 2009, at 01:18, Daniel O'Connor wrote:

> Hey all,
> We need to make a decision regarding the future of Helgi's changelog implementation and the bugtracker.
> 
> There's bugs:
> http://pear.php.net/bugs/bug.php?id=16845
> http://pear.php.net/bugs/bug.php?id=16671
> 
> and I had a bad moment with an XSS bug which was hard to tell if it was exploitable or not at a glance.
> 
> My suggestions here:
> 	•
> 	• Alter the storage on the bug table, add a column: 'rendered_html_changelog (text/varchar)'.
> 	• Remove all of the hacky searching of the comments, make sure they are rendered properly escaped.
> 
> http://svn.php.net/viewvc/pear/pearweb/trunk/public_html/bugs/bug.php?view=markup#l1321
> 
> IE:
>     $search  = "</div>";
>     $needle  = strrpos($comment, $search);
>     if ($needle !== false) {
>         $fix     = substr($comment, $needle + strlen($search)); // Get from last div until end of string
>         $status  = substr($comment, 0, $needle) . $search;
>     }
> 
>     $comment = htmlspecialchars($fix, ENT_QUOTES, 'UTF-8', false);
>     $comment = make_ticket_links(addlinks(clean($comment)));
>     $comment = $status . $comment;
> 
> becomes:
> 
> $comment = make_ticket_links(addlinks($row['comment']);
> $status = $row['rendered_html_changelog'];
> 
> 
> 	• Storing also writes to the appropriate new column
> 	• Measure the number of current bug reports with inline html changelogs, and manually migrate them (hurray for SQLYog) if the number is low (<100).
> Thoughts? Flames? 
> 
> IMO, this is a good balance between  keeping Pretty Changelogs and having to implement a Bug Changelog table / migrate everything.