Bugzilla is one example of a class of programs called "Defect Tracking
Systems", or, more commonly, "Bug-Tracking Systems". Defect Tracking
Systems allow individual or groups of developers to keep track of
outstanding bugs in their product effectively.
Bugzilla has matured immensely, and now boasts many advanced features.
These include:
* integrated, product-based granular security schema
* inter-bug dependencies and dependency graphing
* advanced reporting capabilities
* a robust, stable RDBMS back-end
* extensive configurability
* a very well-understood and well-thought-out natural bug resolution
protocol
* email, XML, console, and HTTP APIs
* available integration with automated software configuration
management systems, including Perforce and CVS (through the
Bugzilla email interface and checkin/checkout scripts)
* too many more features to list
===> The following configuration options are available for bugzilla44-4.4.13_5:
DOCS=on: Build and/or install documentation
MODPERL=off: mod_perl protocol support
====> Options available for the group UI
PATCH_VIEWER=on: Patch Viewer
MORE_HTML=on: More HTML in Product/Group Descriptions
====> Database Engine
MYSQL=off: MySQL database support
PGSQL=off: PostgreSQL database support
SQLITE=off: SQLite database support
====> Reports and Charts
GRAPHVIZ=off: Graphviz graph drawing support
GRAPH_REPORTS=on: Graphical Reports
CHARTING_MODULES=on: Bug charting support
====> Attachment handling
BMP2PNG=off: BMP Attachments to PNGs
MIME_SNIFF=off: Sniff MIME type of attachments
====> Email handling
INBOUND_EMAIL=off: Inbound Email
MAIL_QUEUEING=off: Mail Queueing
SMTP_AUTH=off: SMTP Authentication
====> Web Services
XMLRPC=off: XML-RPC Interface
JSONRPC=off: JSON-RPC Interface
====> Alternative Authentication
LDAP=off: LDAP protocol support
RADIUS=off: RADIUS protocol support
====> Administration
MOVE_BUGZ=off: Move Bugs Between Installations
EXPORT_IMPORT=off: Import/export bugs (via XML)
CONTRIB=on: Install user-contributed scripts
===> Use 'make config' to modify these settings
Bugzilla has now been installed. To quick setup you have to:
1. Create database user who has rights on bugs database manipulation
by following mysql commands (for MySQL 4.0 or later):
GRANT SELECT, INSERT, UPDATE, DELETE, INDEX, ALTER, CREATE, LOCK TABLES,
CREATE TEMPORARY TABLES, DROP, REFERENCES
ON <database>.* TO <dbuser>@<host>
IDENTIFIED BY '<password>';
FLUSH PRIVILEGES;
where <database> is a bugs database name; <dbuser> is a bugs database
owner; <host> is a host there bugzilla is being setup;
<password> is a database owner's password;
2. Change working directory to /usr/local/www/bugzilla
3. Run "./checksetup.pl" script as root user
4. Read output carefully and follow all instructions
For more complete database setup and post-installation instructions
and security tips/notes please read "Bugzilla Guide" in
/usr/local/share/doc/bugzilla/en/html/ (chapter 2: "Installing Bugzilla")
If upgrading
For upgrades:
0. Back up your data.
1. Run the command inside /usr/local/www/bugzilla
find . -mindepth 2 -name .htaccess -exec rm -f {} \;
2. Run "./checksetup.pl" inside /usr/local/www/bugzilla. You may need to
run it several times.
3. Restart your Web server, especially if you're using mod_perl: this
will save you from a number of troubles.
cleanup: Remove expired ports:
2025-06-14 devel/bugzilla44: Upstream support ended 20250103
german/bugzilla44: localized version of devel/bugzilla44
japanese/bugzilla44: localized version of devel/bugzilla44
russian/bugzilla44: localized version of devel/bugzilla44
Event: Kitchener-Waterloo Hackathon 202506
databases/p5-DBD-mysql: Fix for MariaDB users
Add a new variable DBD_MYSQL, use that in *_DEPENDS and add mysql to USES
where required. DBD_MYSQL will automatically set the correct DBD dependency.
In cd16748194e2 databases/p5-DBD-mysql was updated to 5.x, in 5.x the
support for MariaDB was removed and only MySQL >= 8.0 is supported.
In the 4.x releases MariaDB is still supported, according to upstream 4.x
will still be supported for a while [1], so use that for now when we detect
that MYSQL_FLAVOUR is set to mariadb. databases/p5-DBD-mysql4 was added in
d95f49cb3b54.
DBD:MariaDB would be another alternative, but migrating to it might need
more analysis than just staying with the 4.x releases of p5-DBD-mysql. This
(Only the first 15 lines of the commit message are shown above )
Mk/Uses/apache.mk: Refactor after removal of older versions
apache22 and apache25 had been removed a long time ago however the
apache.mk file has never been refactored and is out of sync from the
file Mk/bsd.default-versions.mk. These changes refactors the removals of
the older versions. In addition:
- Move some keywords like USE_APACHE, USE_APACHE_BUILD, USE_APACHE_RUN
from SANITY_DEPRECATED to SANITY_UNSUPPORTED
- Remove apache versions from ports Makefiles as currently there is only
one available version in the tree. However the version checks are
still valid and should work flawlessly whenever a new version is
added. For example USES=apache:2.2+ are simply replaced with
USES=apache. As currently there are no other versions available for
test this could not be checked on it's own ground.
- Update FOO_USE=APACHE=yes to FOO_USES=apache
- Remove trailing whitespaces
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38113
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
framework: Add new USES 'magick' for graphics/ImageMagick*
A new USES has been added to depend on ImageMagick.
USES=magick
adds a LIB_DEPENDS on graphics/ImageMagick${IMAGEMAGICK_DEFAULT}.
If a specific version is required, use for example
USES=magick:6 resp. USES=magick:7
If only a build, run or test is required, use for example
USES=magick:build resp. USES=magick:6,build,test
(Only the first 15 lines of the commit message are shown above )
Update ImageMagick to 6.9.10.14 [1]
* Add PKGNAMESUFFIX and rename the directory. This was done to show
that IM6 is not the "main" version. But still fully supported by upstream.
* Convert a number of options to optionhelpers.
* Add option for ISO/IEC 23008-12:2017 HEIF suport
* Add comment to pkg-descr explaining IM6's "legacy" tag.
* Add comment to the patch-config_policy.xml file why it still needed.
Please note that IM7 is not a drop in replacement due to library API and
command arguments changes. And as a result ports need to decide for themself
which version to use.
Chase these changes in all the ports that using IM6.
PR: 225102 (based on, only the version update) [1]
Submitted by: Pascal Christen <pascal.christen@hostpoint.ch>
Remove USE_SQLITE from bsd.databases.mk, replaced by USES=sqlite.
While there replace USE_SQLITE=x by USES=sqlite:x.
PR: 208971
Submitted by: mat
Exp-run by: antoine
With hat: portmgr
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D5951
- update to 4.4.11
This release fixes two security issues.
See the Security Advisory for details. [1]
This release also contains the following bug fix:
o mod_perl now works correctly with mod_access_compat turned off
on Apache 2.4. The (incorrect) fix implemented in Bugzilla 4.4.9
has been backed out. To regenerate the .htaccess files, you must
first delete all existing ones in subdirectories:
find . -mindepth 2 -name .htaccess -exec rm -f {} \;
You must then run checksetup.pl again to recreate them with the
correct syntax. (Bug 1223790)
[1] https://www.bugzilla.org/security/4.2.15/
MFH: 2015Q4
Security: CVE-2015-8508
CVE-2015-8509
vid="54075861-a95a-11e5-8b40-20cf30e32f6d"
- update bugzilla ports to 5.0.1 / 4.4.10
o Users whose login name is not an email address could not log in on
installations which use LDAP to authenticate users.
o If a mandatory custom field was hidden, it was not possible to create a
new bug or to edit existing ones.
o A user editing his login name to point to a non-existent email address
could cause Bugzilla to stop working, causing a denial of service.
o Emails generated during a transaction made PostgreSQL stop working.
o Bugs containing a comment with a reference to a bug ID larger than 2^31
could not be displayed anymore using PostgreSQL.
o Emails sent by Bugzilla are now correctly encoded as UTF-8.
o The date picker in the "Time Summary" page was broken.
o If Test::Taint or any other Perl module required to use the JSON-RPC API
was not installed or was too old, the UI to tag comments was displayed
anyway, you could tag comments, but tags were not persistent (they were
lost on page reload). Now the UI to tag comments is not displayed at all
until the missing Perl modules are installed and up-to-date.
o Custom fields of type INTEGER now accept negative integers.
MFH: 2015Q3
Security: CVE-2015-4499
Security: ea893f06-5a92-11e5-98c0-20cf30e32f6d
bsd.sites.mk: cleanup MOZILLA mirrors
- Switch to CDN by default as mirrors are no longer kept up to date
- Drop obsolete pointer to http://www.mozilla.org/mirrors.html
- Drop redundant BUGZILLA and MOZILLA_EXTEND
- Shorten MASTER_SITES in gecko@ ports
- Move MOZILLA_ADDONS to bsd.sites.mk
- Move one of MOZILLA mirrors with old addons under MOZILLA_ADDONS
- Addons CDN redirects to https://, so don't mislead with http://
https://blog.mozilla.org/it/2012/08/03/dear-mozilla-mirrors-thank-you/
Differential Revision: https://reviews.freebsd.org/D2550
Tested by: distilator
Reviewed by: mat (partial)
Approved by: bz-ports (ohauer), portmgr blanket (office@ et al.)
Approved by: portmgr (bapt, earlier version)
MFH: 2015Q2
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
Convert remaining p5-CGI.pm consumers to p5-CGI, and bump PORTREVISION.
All these changes are tested but the following are worth noting:
The following ports fail "make test", but did so before this change, and
fail in the same places:
- textproc/p5-xmltv
- www/p5-Business-Paypal
- www/p5-CGI-Enurl
www/p5-Apache-Gallery is missing all sorts of dependencies, fails all tests,
and should probably be marked BROKEN
For graphics/imc, move the OPTIONS_DEFINE block out of the LICENSE block area.
As long as we're here, sort plist on perl@-owned ports.
- Since SOAP::Lite 1.0, XMLRPC::Lite is no longer included
and so it must be installed separately.
- Update min. dependency for some other modules [1]
- bump PORTREVISION
[1] Update min. dependency (ripped from upstream Requirements.pm)
- p5-DateTime-TimeZone>=1.64:
fixes a taint issue preventing the local timezone from being determined on
some systems.
- p5-DateTime>=0.75
fixes a warning thrown with Perl 5.17 and newer
- p5-List-MoreUtils>=0.32
fixes several memory leaks in the XS version of some functions
(Only the first 15 lines of the commit message are shown above )
- list empty dirs (make qa-script happy)
- if PERL_LEVEL >= 501800, then also depend on devel/p5-Module-Pluggable
Module::Pluggable from perl5.18 complains about deprection and this way
cron job notice is no longer readable
- bump PORTREVISION
- update to bugzilla 4.4.6
Summary
=======
The following security issues have been discovered in Bugzilla:
* The 'realname' parameter is not correctly filtered on user account
creation, which could lead to user data override.
* Several places were found in the Bugzilla code where cross-site
scripting attacks could be used to access sensitive information.
* Private comments can be shown to flagmail recipients who aren't in
the insider group
* Specially formatted values in a CSV search results export could be
used in spreadsheet software to attack a user's computer.
Security: CVE-2014-1572
CVE-2014-1571
CVE-2014-1571
Change MAINTAINER to bz-ports@ as discussed with bugzilla@ (now bz-ports@)
and bugmeister@. bugzilla@ will be used by bugmeister@ from now on.
Submitted by: bugzilla (ohauer)
Approved by: bugzilla (ohauer)
Hat: postmaster
- update to bugzilla44-4.4.5
Vulnerability Details
=====================
Class: Cross Site Request Forgery
Versions: 3.7.1 to 4.0.13, 4.1.1 to 4.2.9, 4.3.1 to 4.4.4, 4.5.1 to 4.5.4
Fixed In: 4.0.14, 4.2.10, 4.4.5, 4.5.5
Description: Adobe does not properly restrict the SWF file format,
which allows remote attackers to conduct cross-site
request forgery (CSRF) attacks against Bugzilla's JSONP
endpoint, possibly obtaining sensitive bug information,
via a crafted OBJECT element with SWF content satisfying
the character-set requirements of a callback API.
http://www.bugzilla.org/security/4.0.13/
MFH: 2014Q3
Security: 9defb2d6-1404-11e4-8cae-20cf30e32f6d
CVE-2014-1546
devel/bugzilla44: add FreeBSD specific patch.
Abuse our position as the owner of the ports tree to commit a project specific
option and patch to the bugzilla port.
Approved by: ohauer (maintainer)
- distfiles where regenerated (wrong dependency list in the documentation)
- because there will no upstream fixes for CVE-2014-1517 mark bugzilla40 /
bugzilla42 forbidden and set expiration date to 2014-06-21
- fix the GRAPHVIZ OPTION
- bump PORTREVISION
MFH: 2014Q2
- update to 4.0.12, 4.2.8, 4.4.3
- move BINMODE to Makefile.common so it is also used in the language packs
Security: CVE-2014-1517
Security: 608ed765-c700-11e3-848c-20cf30e32f6d
Security: 60bfa396-c702-11e3-848c-20cf30e32f6d
- update to latest release [1]
- use PKGNAMESUFFIX instead LATEST_LINK
- whitespace cleanup
- svn mv */bugzilla to */bugzilla40
- add vuxml entry
4.4.1, 4.2.7, and 4.0.11 Security Advisory
Wednesday Oct 16th, 2013
Summary
=======
Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:
(Only the first 15 lines of the commit message are shown above )
- Convert to new Uses/perl5.mk framework
- Resolve issues with implicit lang/perl in extract and patch dependencies
- Trim Makefile header
Reviewed by: bapt@ (exp-run)
Approved by: bapt@ (portmrg@)
