Flyspray - The bug killer!

When a Flyspray installation allows user self registration and has public but also more private projects, this feature could make the required configuration more clear:

In this case, keep the number of global user groups as low as possible and the global user group for basic or just registered users has only the ‘can login’ permission and nothing more.
Because that only would be useless for new registered users, adding them also to a basic user group of a public project could be useful.

So my suggestion is:

A new optional global setting: Something like ‘default project user group’ (store 2 values: a project_id and a group_id). Validity of that setting must be checked during any user registration, so that project must exists now and at later time as also that project user group within that project. (’Checks’ of admin prefs)

So it would be like this for a new registered userA:

1. userA is in a basic default global user group: only login permission to handle his account registration (login, logout, user preferences, password forgotten)
2. userA is in project X default user group: some basic permissions you want allow for every (new) registered user in project X
3. project Y: all ‘allow anyone ...’-settings are unchecked, userA not in any user group of project Y

The setting is probably best put below the ‘Default global group for new users’ setting in the global admin prefs tab #userregistration as

Either: A dropdown list with all public projects with an existing user group and dependend on the selection the available basic project groups are loaded by ajax as a select list too.

Or: Only one dropdown list that contains a list of public projects with possible project user groups. Would not require extra ajax calls and is maybe enough because we could exclude project groups that have project manager permission or such configuration nobody would allow new registered users.

no default project user group
public projectA - simple user groupA1
public projectA - simple user groupA2
public projectB - simple user groupB
public projectC - simple user groupC

This idea could be enhanced further (put the new user to multiple public projects when he registers or let user choose from public allowed projects during registration process), but lets start simple.

Currently the sessions are stored by the webservers default settings.

Having this sessions under control by Flyspray by storing it in the database has following advantages:

1. Allows handling of all sessions of a user by Flyspray.
2. Providing a session management for each user. The user can see on which devices he is currently logged in and could also force a logout on selective devices.
3. A forced logoff of all or some user sessions is easy implementable for admins.
4. Statistics about how many users and who is logged in. (user status: hide always, online, offline, do not disturb, ..)
5. Could make onpage-notifications easier to implement.
6. .. ?

Disadvantages:

1. A potential unknown security bug in Flyspray that could lead to reading a session db table could leak informations like who is currently online/active and make further attacks more focused or makes session takeover easier.
2. .. ?

Bugs

Missing features

This task can maybe splitted into separate sub tasks.

Task properties

Current situation

Ideas

Multi select option styling

Custom fields

I would like to restrict certain projects from view from normal users (Basic group.) I couldn’t find out a way to do it. I could restrict them from viewing tasks, which is good, but it would be nice to hide the project entirely from the Overview screen.

Some project and user settings should be able to set back to its default or 'auto' option.

• flyspray or project wide task list length, currently hard coded to 250
• user tasks_perpage setting
• user notifytype
• user timezone
• user language (system/project and auto (browser detection) selectable)
• ...

Some translation keywords of Flyspray are used at more than one code location.

To help translators doing the correct translations, it would help to show in what context a translation keyword is used.
Especially when a keyword is used more than once.

As we have our own translation helper integrated into Flyspray, we could show a ‘translation keyword usage counter’ there and maybe show on request in which file
a translation keyword is used.

It would also help to identify ‘abandoned’ translation keywords that are not used anymore by Flyspray source.

I think we can use a regular expression and scan the whole Flyspray source for that.
(and maybe database entries if there are places that have translation keywords stored - I don’t think so, but better check that too first than forget that case)

The regular expression should match that examples case insensitive for the translation keyword report:

L('report' 
L("report"
eL('report'
eL("report"

but also ugly cases like
l(    'report'
or 
El ( "report"

case insensitive.

But not for example

createURL('report'

Steps done to create the problem:
Visit https://bugs.flyspray.org/index.php?do=register in a private browser window (so you are logged out)

Put in an already taken username (e.g. Stefan or Stefan2)

Expected behavior:
Username gets red and a note appears that username already is taken

Experienced behavior:
Username gets green and registration of a new user proceeds with sending a notification mail with confirmation code.
After putting in the confirmation code in provided page, user gets presented a “username is already taken, choose another” (where?) message, and has to re-start registration process from beginning and hopefully this time choose a not taken name.

Spammers have found a way to bypass the block on user registration and cause entries to be inserted into the registrations table in the database. I have 30+ of them in there right now, all inserted within the last 2 days. I’ve had user registrations disabled for 2 weeks now because of an onslaught of spammers who won’t leave us alone. Flyspray has insufficient safeguards against them so when this happens I have little choice.

I don’t have any idea how, but these entries in the registrations table are resulting in emails being sent out to these accounts that are bouncing because the spammers are on domain blocklists for forging their DNS responses.

Something needs to be done about this, because if they can insert phantom entries into this database table via the code, what else could they be doing that we haven’t spotted yet?

Steps done to create the problem:
Access /index.php?do=admin&area=checks with a MySQL Version >= 5.5.3

Expected behavior:
Flyspray tests for character set and displays »Your mysql supports full utf-8 since 5.5.3. You are using x.x.x and flyspray tables could be upgraded.« when database schema or one table isn’t set to utf8mb4 character set.

Experienced behavior:
Flyspray always shows this note, even though character set is correct.

As far as I can tell from the source, a query gets executed to the database (and if I do that manually the result is “utf8mb4, utf8mb4_unicode_ci” for my database), but the result doesn’t get checket, the note is always shown (line 123)

I have changed the htaccess.dist into .htaccess and modified to force https.
However, despite having https activated on my site I cannot get Flyspray running, it’s waiting forever.When I abort I get a page without makeup. I have all other applications like cms and wiki running under https, so it is something I have not done in the flyspray configs obviously (as this site is running https too). But could you give me a hint?

I installed flyspray in a subdirectory, if that is something to know about...

regards, Albert

Did you installed an official release or did you used an inoffical docker?!
Yeah
MySQL 8.0.12, 7.2.9 on debian buster

Steps done to create the problem:
Enter server:port at Mail-Settings

Expected behavior:
smtp.example.com:customport would make use of the custom port

Experienced behavior:
TLS Errors

          if ($fs->prefs['email_tls']) {
              $swiftconn = Swift_SmtpTransport::newInstance($fs->prefs['smtp_server'], 587, 'tls');
          } else if ($fs->prefs['email_ssl']) {
              $swiftconn = Swift_SmtpTransport::newInstance($fs->prefs['smtp_server'], 465, 'ssl');
          } else {
              $swiftconn = Swift_SmtpTransport::newInstance($fs->prefs['smtp_server']);
          }

Should be changed to

          $someTemporaryVariable = explode(':',$fs->prefs['smtp_server']);
          if ($fs->prefs['email_tls']) {
              $swiftconn = Swift_SmtpTransport::newInstance($someTemporaryVariable[0], $someTemporaryVariable[1] || 587, 'tls');
          } else if ($fs->prefs['email_ssl']) {
              $swiftconn = Swift_SmtpTransport::newInstance($someTemporaryVariable[0], $someTemporaryVariable[1] || 465, 'ssl');
          } else {
              $swiftconn = Swift_SmtpTransport::newInstance($someTemporaryVariable[0], $someTemporaryVariable[1] || 25);
          }

flyspray version: 1.0-rc6

How to reproduce:
Create a bug with tags (preferable with spaces)
Edit this bug
Change the spaces to ‘,’ Save

Expected behaviour:
Saves the tag with comma (even ; is the correct seperator).
It looks to me, that sanitisation of user input is missing here.

I use a personal email server with a self-signed certificate (i’m not sure if it’s possible to use my https certificate for that? i don’t even kind of understand what all I did to get this email server setup, and I don’t really want to mess with it... especially since my https certificate comes from Let’s Encrypt... so i might have to muck with the email server every 60 days ... not sure?) ..

anyway, when I try to connect to it with Flyspray, I get above the Test Email button, “Completely unexpected exception: Unable to connect with TLS encryption
This should never happend, please inform Flyspray Developers”

Most systems have a way to override and accept an invalid cert, but I’m not seeing anything obvious about doing that with Flyspray. Does a function for this already exist, or do we need a way to do that? (alternatively, I would accept help in properly configuring my email lol)

Hi, in order for us to push our name (rather than flyspray) on emails, notifications, and GUI we had to edit the language file to replace the text “flyspray” with our install site name. That way notifications come from our company name rather than flyspray.

It would be nice if you could take the site name variable and add it to the language files in all keys that face the public user and all notifications. This would not only prevent editing of the lang file but also make setup alot faster.

Thanks so much..
Dave

The issue with many servers now and the reason that recaptcha does not work is because it requires servers to enable allow_url_fopen which is a huge security risk. That is why you get the warning message when you try to run recaptcha that file_get_contents failed to connect.

So the solution is to use Curl to do that job.

Here is the fixed file, excuse my mess i had not cleaned up my code yet... but recaptcha now works.

this file goes in the includes dir... you can clean up the file if you like again sorry about that.

So, I’ve been away from Flyspray for more than a few years. When I tried to login to the Flyspray here, I was unable to login, because I don’t remember my username, and I was unable to retrieve my username, because there’s no function for that. I was *also* unable to re-register the same email address. SO, having an account system that requires both unique usernames and unique email addresses, but has no way of retrieving one from the other, doesn’t work out so well.

Suggestion: either use email as username, or add a function to retrieve username (perhaps along with password retrieval . . password retrieval would then have to take username -or- email, probably)

Hi, i made a way to integrate slack in flyspray using webhooks.. i not added to git.. if some can add for me it’s ok.

The process is simple.. maybe in the front the team can add a field for add the webhook for each action could be better.. in this moment the webhook is triggered only for newtask using the log method.. but you can simply add some “if” for each “type” of log.

Process:

1. Create a new field in the table flyspray_users named “slack”, and add the user slack for each user.
2. Edit the file /includes/class.flyspray.php , go to the function “logEvent” and change it by this:

public static function logEvent($task_id, $type, $newvalue = '', $oldvalue = '', $field = '', $time = null)
			{
				global $db, $user;
 
				// This function creates entries in the history table.  These are the event types:
				//  0: Fields changed in a task
				//  1: New task created
				//  2: Task closed
				//  3: Task edited (for backwards compatibility with events prior to the history system)
				//  4: Comment added
				//  5: Comment edited
				//  6: Comment deleted
				//  7: Attachment added
				//  8: Attachment deleted
				//  9: User added to notification list
				// 10: User removed from notification list
				// 11: Related task added to this task
				// 12: Related task removed from this task
				// 13: Task re-opened
				// 14: Task assigned to user / re-assigned to different user / Unassigned
				// 15: This task was added to another task's related list
				// 16: This task was removed from another task's related list
				// 17: Reminder added
				// 18: Reminder deleted
				// 19: User took ownership
				// 20: Closure request made
				// 21: Re-opening request made
				// 22: Adding a new dependency
				// 23: This task added as a dependency of another task
				// 24: Removing a dependency
				// 25: This task removed from another task's dependency list
				// 26: Task was made private
				// 27: Task was made public
				// 28: PM request denied
				// 29: User added to the list of assignees
				// 30: New user registration
				// 31: User deletion
				// 32: Add new subtask
				// 33: Remove Subtask
				// 34: Add new parent
				// 35: Remove parent
 
				$query_params = array(intval($task_id), intval($user->id),
				((!is_numeric($time)) ? time() : $time),
				$type, $field, $oldvalue, $newvalue);
 
                               // CREATE A NOTIFICATION IN SLACK WHEN A NEW TASK IS CREATED ONLY TO THE USER SELECTED
				if ($type == 14) {
 
					$usuarios = $db->query("SELECT DISTINCT a.slack, c.item_summary, d.project_title
						FROM {users} a
						JOIN {assigned} b on b.user_id = a.user_id
						JOIN {tasks} c on c.task_id = b.task_id
						JOIN {projects} d on d.project_id = c.project_id
						WHERE b.task_id = ?
						and a.slack <> '-'", array(intval($task_id)));
						$slackUsers = $db->fetchAllArray($usuarios);
 
						foreach ($slackUsers as $users) {
							    // GET THE USERS FOR IN THE SLACK TO SEND THE NOTIFICATION.
							$data = array(
								'text' => "New task: Project: " . $users['project_title'] . " | summary: " . $users['item_summary'] . " | taskId:" . $task_id ,
								'username' => "bott inslack",
								'link_names' => "1",
								'channel' =>  "@" . $users['slack'],
								'icon_emoji' => ":panda_face:"
							);
 
							$options = array(
								'http' => array(
									'header'  => 'Content-type: application/x-www-form-urlencoded\r\n',
									'method'  => 'POST',
									'content' => json_encode($data)
								)
							);
 
                                                      // DEFINE SLACK WEBHOOK
							$context  = stream_context_create($options);
							$result = file_get_contents("https://hooks.slack.com/services/xxxxxxxxx", false, $context);
 
						}
 
					}												
 
					if($db->query('INSERT INTO {history} (task_id, user_id, event_date, event_type, field_changed,
						old_value, new_value) VALUES (?, ?, ?, ?, ?, ?, ?)', $query_params)) {
 
							return true;
						}
 
						return false;
					}

It would be great to be able to configure a slack webhook that would post to a channel any task creation/deletion/modification.

Hello,

I’m having an issue on the notification’s mail sent to people when quick-editing a task, more precisely on the link to the task below.

I had this in my older mails :
mybugtracker.com/js/callbacks/index.php?do=details&task_id=xxxx

I “corrected” it by adding a str_replace here (see my screenshot), and now it’s good.

Thank you

I’ve set up an account with a username longer than 20 characters, but can’t reset the password because the
flyspray/index.php?do=lostpw
page username field has maxlength=”20” The maxlength for a new user registration seems to be 32 characters.

A related concern is that when setting up the default/admin user on first load of the system, I can use an email address as username (always my preference), but it’s actually not a valid username to create for others thereafter. Consider allowing ‘@’ character in usernames.

When a user has project manager permissions, but not admin permissions, then on the ‘edit group’ pages like index.php?do=pm&area=editgroup&id=8
the links in the list of users of that group are

index.php?do=admin&area=users&user_id=12345

instead of linking to the users page

index.php?do=user&area=users&id=12345

and a redirect follows with Error #4: You don’t have administrative rights.

Why can’t I set my own password during installation? I thought I did, but it created a different password.

Just relabel it to say “tag”.
—

OK, that’s everything i’ve noticed in my 30-45 minutes of playing around... hope you find any of this helpful!

I get that your project is public and you want people visiting this site to see what issues you’re working on, but most people probably don’t want their bugs list open to the public;

Can this be protected/private by default?

Save public files inside public or public_html directories, and non-public files outside of those directories;

config file

vendor directory

setup logic

etc

This goes onto another question/point - why are you deleting files from the vendor directory? It happens during composer install, and again after installation? Those files will just get put back if the user ever runs composer install again...

(Working on a network monitoring system that really needs a ticketing system, saw this and since I speak PHP, thought it would be a good place to start... I just installed and am sharing my notes, do with them what you will!)

why not store all the user preferences in preferences or user_prefernces? Then users can just be simple username, email, password?

the old php mysql extension is long ago reached its demise, why bother supporting it?

I also see in the database connector that your supporting MySQL/PDO - why not settle on that? If the queries aren’t MySQL specific, it becomes easier to support other DB’s, etc.

Then you can gracefully drop support of old MySQL extension AND drop the need for password compat, since BCRYPT and password_hash are built into PHP from version 5.5 onwards

That way you can just protect the setup routes after installation, etc.

And have a much less cumbersome .htaccess file.

And take sensitive files outside of the server path and not risk letting them get out in the public

Correct or wrong code return false!

The results of Securimage Test Script on my server

This script will test your PHP installation to see if Securimage will run on your server.

Session Functionality: Yes!
GD Support: Yes!
GD Version: bundled (2.1.0 compatible)
imageftbbox function: Yes!
TTF Support (FreeType): Yes!
JPEG Support: Yes!
PNG Support: Yes!
GIF Read Support: Yes!
GIF Create Support: Yes!
SQLite Support: Yes!
SQLite is available. If you choose to use it, Securimage can support users who do not accept cookies.
MySQL Support: Yes!
MySQL is available. If you choose to use it, Securimage can support users who do not accept cookies by storing codes in MySQL.
PostgreSQL Support: No
No PostgreSQL support.
LAME MP3 Support: No
LAME was not found, audio will work in WAV format, but not MP3. See Securimage HTML5 audio documentation for info.
Your server meets the requirements for using Securimage!

on modify.inc.php line:754 got

if( !Post::isAlnum('captcha_code') || !$image->check(Post::val('captcha_code'))) {

if( true == false || false == false ) {

It would be helpful to have communication with LDAP via TLS

When some url to a bug is redirected to the login page, because the user does not have the right to see the bug without login, the user should be redirected after the login to the url he wanted to see.

Maybe redirect to /login/?next=/task/X and put the next-url in a hidden field in the login-form, so flyspray can redirect to the correct page after login.
Even preserving anchor-urls (#comment-YYYY) would be cool, but i guess this needs Javascript to work.

make a option in configuration file

me need set same $db1→set_charset(’utf8mb4’); for my MySQLi

have a problem with national letters

I see this error after i try enter national letters to the summary input text field for create new task

Query {UPDATE `flyspray_tasks` SET project_id = ?, task_type = ?, item_summary = ?, detailed_desc = ?, item_status = ?,
 mark_private = ?, product_category = ?, closedby_version = ?, operating_system = ?, task_severity = ?, task_priority = ?, 
last_edited_by = ?, last_edited_time = ?, due_date = ?, percent_complete = ?, product_version = ?, estimated_effort = ?
 WHERE task_id = ?} 
with params {1,1,тестовая задача,<p>sdfsdfdsfsd</p> ,2,0,4,0,1,2,4,1,1441344777,0,0,1,0,2} Failed!
(Incorrect string value: '\xD1\x82\xD0\xB5\xD1\x81...' for column 'item_summary' at row 1)

Standardize the priority meaning across flyspray translations.

Idea:

0 - priority unset (database field default value)

1 - defer (or very low priority, often results the task is defered, see “Eisenhower principle”)
2 - low
3 - normal
4 - high
5 - very high

6 - flash (house burns, catastrophic event, website down, “boss” decision)

Some other software (other task planers/ email programs) use a 1-5 step priority. So an export feature to other software may merge priority 6 to priority 5 for such software.

In 2012 meaning was changed only in english translation.

Before normal was priority 2 in a 1-6 range, after it is priority 4 in a 1-6 range.
It should be IMHO 3 in that 1-6 range.

You cannot select the fields for export to csv. This means that the commentfield is always exported too. As this commentfield could contain quotes, comma’s etc (like people inserting copies of emails on an issue) it corrupts the output file and the file cannot be read by excel.

It would be great if the Admin Toolbox had an attachments section with an on/off switch, a max size setting, and it would print out all the reasons why it can’t set it to your desired value.

This would help in situations like  FS#2458 , it would be more clear if there is a setting to turn on/off attachments instead of turning them on and off by setting the rights if the attachments folder.

This way if the attachments setting is On, the GUI could also print an error “Attachments folder must be writable” when it detects that the writable attribute does not match the desired setting.

After updating from “1.0-rc6” to “1.0-rc7 dev” there is missing controls menu on writer. Look attachment.
How to solve this?

Is there any settings to enable this or I’m missing something...

Problem: https://github.com/Flyspray/flyspray/pull/552

The button ‘My assigned tasks’ should search only by userid, not in username or realname with the LIKE ‘%...%’ operator.

Currently the button is using the same as doing an advanced search filling the ‘Assigned To’ input field. (currently ‘dev’ param) But that search param searches in userid, username and realname.

Edit: Implemented simpler solution: if param is digitsonly, then search by userid, otherwise by username and realname if that param exists.

This could be done by a textarea field (like comment text or task description) on the myprofile page and stored in a new field (of type text for instance) in the user table.

This allows the user to introduce himself to the other users.

Should be restrictive, for instance only simple text allowed, no html or tags.

Since PHP7.2 shows a warning in admin area ?do=admin&area=users&user_id=1234567890, when user_id is set, but no alternative user_name parameter.

Probably related to scripts/admin.php

$id = Flyspray::UserNameToId(Req::val('user_name'));
if (!$id) {
  $id = Req::val('user_id');
}

On creating task we got error on event which must send e-mail via “google mail”.

I hoped that in rc6 this will be solved but not. This error was the same on rc4.

Geshi 1.0.8.17 from https://github.com/easybook/geshi is quite slow at the current integration of Flyspray v1.0-rc3 on the first run. (But any further read uses the cache.)

But it produces garbled output for xml code highlighting:

Example without xml, just format as preformatted code:

<table>blabla</table>

Or as php syntax highlighting (even if it doesn’t contain a real php-tag ):

<table>blabla</table>

Example with xml choosen as language:

blabla

The table tag is stripped away instead of converting the tag for output inside code/pre tags (by converting the < and > chars). Maybe just a configuration issue?

Currently the task list columns are used, which are choosed by admin or project manager for the task list view.

Hello Peter,

I am interested in making the following mod:

When posting a new task, category should be blank by default, in order for the user that opens a new task to select that specific category.
If he doesn’t select any task, when pressing Add this task button, FlySpray should display an error message saying that the Category hasn’t been specified.

Do you think this mod can be made with the current version?
If so, do you mind if you help me a bit with the things that need to be modified?

Thanks!

Currently the category_id is not checked if the value is legal for the project when a new task is created.

• must be unsigned int
• must be an active category_id of the project or global category.
• setting a category_id must be allowed - see project settings.

If invalid category_id is sent, deny creating task and show error message and show filled form again.

If no category_id is sent (or empty string) and category select is enabled:

• either choose a default category

or

• implement feature request FS#2451 and show that user should select a category.

The only (only!) feature that I have missing in Flyspray is an option to receive email notifications when a new task is created

I think that this could be in the profile of the user, and/or in the main configurations as “send a notification to the -group- (admins?) when a new task is created”

Thanks a lot! flyspray r00lz after all these years, never failed, no bugs, no hacks, fast and efficient! :)

A Happy user.

The last version of Flyspray is simply amazing! it works like a charm :)

This is a small bug report in the eventlog page, that shows this message:

Notice: unserialize(): Error at offset 237 of 808 bytes in /home/elivebugs/bugs.elivecd.org/themes/CleanFS/templates/reports.tpl on line 88 Notice: unserialize(): Error at offset 229 of 796 bytes in /home/elivebugs/bugs.elivecd.org/themes/CleanFS/templates/reports.tpl on line 88

There’s a small screenshot: http://main.elivecd.org/ss/display.php?image=e-59f2541a445543.02125094.jpg

Thank you!
Thanatermesis

At work, we would need to be able to do extractions from the list of regular Flyspray tasks. Have you the ability to integrate this functionality into the interface later.