gnatsweb and cookies

gnatsweb and cookies

[Michael Richardson]

  Any change that there might a way to have view-only access to gnatsweb.pl
and not need any cookies? Ideally a URL that I could give out that would pull
up the view mode, but not go through any authentication at all, and not
require that cookies be enabled?

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [

_______________________________________________
Help-gnats mailing list
Help-gnats@gnu.org
http://mail.gnu.org/mailman/listinfo/help-gnats

Re: gnatsweb and cookies

[Dirk Bergstrom]

On 3/12/2002 11:32 AM, Michael Richardson opined:
>   Any change that there might a way to have view-only access to gnatsweb.pl
> and not need any cookies? Ideally a URL that I could give out that would pull
> up the view mode, but not go through any authentication at all, and not
> require that cookies be enabled?

well, it would certainly be possible to convince gnatsweb to work that way.

i don't know that it would be easy, and i'm not sure that it would be
worth the trouble.  if all you want is the ability to pull up a PR given
a PR number, i'd suggest a simple cgi wrapper around query-pr (with
*lots* of input checking...).  this will take a lot less time and
trouble, and give you what you need.

-- 
Dirk Bergstrom                   dirk@juniper.net
Computer Geek                     v: 707.433.0564
Juniper Networks Inc.             f: 707.433.0769

"it *looks* like a nail; lemme grab my hammer..."


_______________________________________________
Help-gnats mailing list
Help-gnats@gnu.org
http://mail.gnu.org/mailman/listinfo/help-gnats

Re: gnatsweb and cookies

[Gerald Pfeifer]

On Tue, 12 Mar 2002, Dirk Bergstrom wrote:
> On 3/12/2002 11:32 AM, Michael Richardson opined:
> >   Any change that there might a way to have view-only access to gnatsweb.pl
> > and not need any cookies? Ideally a URL that I could give out that would pull
> > up the view mode, but not go through any authentication at all, and not
> > require that cookies be enabled?
>
> well, it would certainly be possible to convince gnatsweb to work that way.
>
> i don't know that it would be easy, and i'm not sure that it would be
> worth the trouble.  if all you want is the ability to pull up a PR given
> a PR number, i'd suggest a simple cgi wrapper around query-pr (with
> *lots* of input checking...).  this will take a lot less time and
> trouble, and give you what you need.

Actually, it seems surprisingly simple. ;-) Below you'll find a patch due
to Jason Molenda (CC:ed) which we have been using on gcc.gnu.org; some-
thing similiar for use with current GNATS/gnatsweb should be relatively
simple, I guess.

Gerald

Index: gnatsweb.pl
===================================================================
RCS file: /cvs/gcc/wwwdocs/cgi-bin/gnatsweb.pl,v
retrieving revision 1.49
retrieving revision 1.50
diff -u -3 -p -r1.49 -r1.50
--- gnatsweb.pl 2001/12/18 21:11:00     1.49
+++ gnatsweb.pl 2001/12/19 07:22:34     1.50
@@ -3501,6 +3501,13 @@ sub main
   $global_prefs{'database'}="gcc";
   #GCC-LOCAL end.

+  #GCC-LOCAL begin: No username/pass provided?  Default to guest/guest
+  if (!$db_prefs{'user'} || !$db_prefs{'password'}) {
+    $db_prefs{'user'} = "guest";
+    $db_prefs{'password'} = "guest";
+  }
+  #GCC-LOCAL end.
+
   # Big old switch to handle commands.
   if($cmd eq 'store query')
   {


_______________________________________________
Help-gnats mailing list
Help-gnats@gnu.org
http://mail.gnu.org/mailman/listinfo/help-gnats

Re: gnatsweb and cookies

[Jason Molenda]

Yeah, this approach has worked pretty well.  If the client doesn't
provide an existing cookie, we assume they're a read-only user
(guest/guest on this system) by default.  If they want to authenticate,
they have to manually go to the Login screen.  Given that most
read/write users will only need to do this one time, it is the
appropriate burden of effort.

Because new/non-cookie-accepting users aren't run through the Login
screen the default, they can get by without cookies.

I wrote this little patch a while back and I may be mis-remembering
some of the details of its effects, but that's the gist of it.

Jason


On Fri, Mar 15, 2002 at 04:42:21PM +0100, Gerald Pfeifer wrote:

> Actually, it seems surprisingly simple. ;-) Below you'll find a patch due
> to Jason Molenda (CC:ed) which we have been using on gcc.gnu.org; some-
> thing similiar for use with current GNATS/gnatsweb should be relatively
> simple, I guess.
> 
> Gerald
> 
> Index: gnatsweb.pl
> ===================================================================
> RCS file: /cvs/gcc/wwwdocs/cgi-bin/gnatsweb.pl,v
> retrieving revision 1.49
> retrieving revision 1.50
> diff -u -3 -p -r1.49 -r1.50
> --- gnatsweb.pl 2001/12/18 21:11:00     1.49
> +++ gnatsweb.pl 2001/12/19 07:22:34     1.50
> @@ -3501,6 +3501,13 @@ sub main
>    $global_prefs{'database'}="gcc";
>    #GCC-LOCAL end.
> 
> +  #GCC-LOCAL begin: No username/pass provided?  Default to guest/guest
> +  if (!$db_prefs{'user'} || !$db_prefs{'password'}) {
> +    $db_prefs{'user'} = "guest";
> +    $db_prefs{'password'} = "guest";
> +  }
> +  #GCC-LOCAL end.
> +
>    # Big old switch to handle commands.
>    if($cmd eq 'store query')
>    {

_______________________________________________
Help-gnats mailing list
Help-gnats@gnu.org
http://mail.gnu.org/mailman/listinfo/help-gnats

Re: gnatsweb and cookies

[Michael Richardson]

>>>>> "Gerald" == Gerald Pfeifer <pfeifer@dbai.tuwien.ac.at> writes:
    Gerald> Actually, it seems surprisingly simple. ;-) Below you'll find a
    Gerald> patch due 
    Gerald> to Jason Molenda (CC:ed) which we have been using on gcc.gnu.org;
    Gerald> some- 
    Gerald> thing similiar for use with current GNATS/gnatsweb should be
    Gerald> relatively 
    Gerald> simple, I guess.

  I had to move stuff a bit, and I had to force the database if not set
(I think you have a patch above to do that), resulting in.

  Note that this actually breaks all logins - the logout button would remove
the cookies, but that puts me back to the view stuff. That's okay, I wanted
read only access anyway.

adams-[/usr/local/src/gnatsweb] mcr 1024 %cvs diff -u gnatsweb.pl
Index: gnatsweb.pl
===================================================================
RCS file: /cvsroot/gnatsweb/gnatsweb/gnatsweb.pl,v
retrieving revision 1.93
diff -u -r1.93 gnatsweb.pl
--- gnatsweb.pl 23 Feb 2002 04:11:13 -0000      1.93
+++ gnatsweb.pl 21 Mar 2002 22:49:18 -0000
@@ -4129,6 +4129,17 @@
   ### Cookie-related code must happen before we print the HTML header.
   init_prefs();
 
+  if(!$global_prefs{'database'}) {
+       $global_prefs{'database'}="freeswan";
+  }
+
+  #GCC-LOCAL begin: No username/pass provided?  Default to guest/guest
+  if (!$db_prefs{'user'} || !$db_prefs{'password'}) {
+    $db_prefs{'user'} = "view";
+    $db_prefs{'password'} = "view";
+  }
+  #GCC-LOCAL end.
+
   if(!$global_prefs{'database'}
         || !$db_prefs{'user'} || !$db_prefs{'password'})
   {
@@ -4138,6 +4149,7 @@
     login_page($q->self_url());
     exit();
   }
+
 
   # Big old switch to handle commands.
   if($cmd eq 'store query')

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [



_______________________________________________
Help-gnats mailing list
Help-gnats@gnu.org
http://mail.gnu.org/mailman/listinfo/help-gnats