Bug 1070979 - Access to /var/lib/bugzilla/data/webdot is denied by default bugzilla.conf
Summary: Access to /var/lib/bugzilla/data/webdot is denied by default bugzilla.conf
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: bugzilla
Version: 20
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Emmanuel Seyman
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-02-27 20:43 UTC by Joel Uckelman
Modified: 2018-04-11 17:33 UTC (History)
5 users (show)

Fixed In Version: bugzilla-4.2.13-1.fc20
Clone Of:
Environment:
Last Closed: 2015-02-15 03:24:25 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Joel Uckelman 2014-02-27 20:43:09 UTC
Description of problem:

Bugzilla writes files for dependency graphs to /var/lib/bugzilla/data/webdot, but there's nothing in /etc/httpd/conf.d/bugzilla.conf which makes that directory accessible, and no note in /usr/share/doc/bugzilla/README.fedora about needing to add that to make it so.

The fact that the URLs show up starting with "/var/lib/bugzilla/data/webdot" in the pages generated by showdependencygraph.cgi make this a rather confusing problem to troubleshoot in the first place, so at least a note someplace would be helpful.

Version-Release number of selected component (if applicable):

bugzilla-4.2.7-3.fc20.noarch


How reproducible:

Always


Steps to Reproduce:
1. Set bugzilla to use /usr/bin/dot to generate dependency graphs.
2. Follow the "graph" link from a bug.

Actual results:

From /var/log/httpd/error_log:

[Thu Feb 27 21:24:58.051790 2014] [authz_core:error] [pid 9812] [client 46.5.0.1
78:40506] AH01630: client denied by server configuration: /var/lib/bugzilla/data
/webdot/sY2TsNhW6A.png, referer: http://www.vassalengine.org/tracker/showdepende
ncygraph.cgi?id=10893

Expected results:

Graph should load in the browser.


Additional info:

I added this to /etc/httpd/conf.d/bugzilla.conf:

<Directory /var/lib/bugzilla/data/webdot>
  Require all granted
</Directory>

That was sufficient to make it work. Additionally, the /var/lib/bugzilla/data/webdot/.htaccess should have "<FilesMatch \.(png|map)$>" instead of just "<FilesMatch \.png$>", since the *.map files are needed for providing the hyperlinks in the dependency graphs.

Comment 1 Emmanuel Seyman 2015-01-20 22:30:59 UTC
(In reply to Joel Uckelman from comment #0)
> 
> Bugzilla writes files for dependency graphs to
> /var/lib/bugzilla/data/webdot, but there's nothing in
> /etc/httpd/conf.d/bugzilla.conf which makes that directory accessible, and
> no note in /usr/share/doc/bugzilla/README.fedora about needing to add that
> to make it so.

You're right. I've fixed this in rawhide. I need to test this and I'll backport the fix soon (along with an update to 4.4.7, by the looks of it).

> The fact that the URLs show up starting with "/var/lib/bugzilla/data/webdot"
> in the pages generated by showdependencygraph.cgi make this a rather
> confusing problem to troubleshoot in the first place, so at least a note
> someplace would be helpful.

Indeed. A while back, I set out to fix this (by making the url match what you would get by installing bugzilla from the tarball) and it got lost in the haystack of things I need to do.

> I added this to /etc/httpd/conf.d/bugzilla.conf:
> 
> <Directory /var/lib/bugzilla/data/webdot>
>   Require all granted
> </Directory>

Added.

> That was sufficient to make it work. Additionally, the
> /var/lib/bugzilla/data/webdot/.htaccess should have "<FilesMatch
> \.(png|map)$>" instead of just "<FilesMatch \.png$>", since the *.map files
> are needed for providing the hyperlinks in the dependency graphs.

The webdot directory and everything it contains is created by Bugzilla when you run the checksetup.pl program. Have you filed a bug in Mozilla's bugzilla instance about this?

Comment 2 Fedora Update System 2015-02-04 08:52:21 UTC
bugzilla-4.2.13-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/bugzilla-4.2.13-1.fc20

Comment 3 Fedora Update System 2015-02-04 08:52:29 UTC
bugzilla-4.4.8-1.fc21.1 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/bugzilla-4.4.8-1.fc21.1

Comment 4 Fedora Update System 2015-02-05 05:23:51 UTC
Package bugzilla-4.2.13-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing bugzilla-4.2.13-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-1699/bugzilla-4.2.13-1.fc20
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2015-02-15 03:24:25 UTC
bugzilla-4.4.8-1.fc21.1 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-02-15 03:24:58 UTC
bugzilla-4.2.13-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.