Fix for bug 98602: re-implementation of "create attachment" page.

Attachment.pm

@@ -72,16 +72,13 @@ sub list
   my @attachments = ();
   while (&::MoreSQLData()) {
     my %a;
-    ($a{'attachid'}, $a{'date'}, $a{'mimetype'}, $a{'description'}, $a{'ispatch'}, $a{'isobsolete'}) = &::FetchSQLData();
+    ($a{'attachid'}, $a{'date'}, $a{'contenttype'}, $a{'description'}, $a{'ispatch'}, $a{'isobsolete'}) = &::FetchSQLData();
 
     # Format the attachment's creation/modification date into something readable.
     if ($a{'date'} =~ /^(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)$/) {
         $a{'date'} = "$3/$4/$2 $5:$6";
     }
 
-    # Quote HTML characters (&<>) in the description so they display correctly.
-    $a{'description'} = &::value_quote($a{'description'});
-
     # Retrieve a list of status flags that have been set on the attachment.
     &::PushGlobalSQLState();
     &::SendSQL(" 

Bugzilla/Attachment.pm

@@ -72,16 +72,13 @@ sub list
   my @attachments = ();
   while (&::MoreSQLData()) {
     my %a;
-    ($a{'attachid'}, $a{'date'}, $a{'mimetype'}, $a{'description'}, $a{'ispatch'}, $a{'isobsolete'}) = &::FetchSQLData();
+    ($a{'attachid'}, $a{'date'}, $a{'contenttype'}, $a{'description'}, $a{'ispatch'}, $a{'isobsolete'}) = &::FetchSQLData();
 
     # Format the attachment's creation/modification date into something readable.
     if ($a{'date'} =~ /^(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)$/) {
         $a{'date'} = "$3/$4/$2 $5:$6";
     }
 
-    # Quote HTML characters (&<>) in the description so they display correctly.
-    $a{'description'} = &::value_quote($a{'description'});
-
     # Retrieve a list of status flags that have been set on the attachment.
     &::PushGlobalSQLState();
     &::SendSQL(" 

CGI.pl

@@ -42,7 +42,6 @@ use strict;
 
 sub CGI_pl_sillyness {
     my $zz;
-    $zz = %::FILENAME;
     $zz = %::MFORM;
     $zz = %::dontchange;
 }
@@ -148,46 +147,63 @@ sub ProcessFormFields {
 
 
 sub ProcessMultipartFormFields {
-    my ($boundary) = (@_);
-    $boundary =~ s/^-*//;
-    my $remaining = $ENV{"CONTENT_LENGTH"};
+    my ($boundary) = @_;
+
+    # Initialize variables that store whether or not we are parsing a header,
+    # the name of the part we are parsing, and its value (which is incomplete
+    # until we finish parsing the part).
     my $inheader = 1;
-    my $itemname = "";
-#    open(DEBUG, ">debug") || die "Can't open debugging thing";
-#    print DEBUG "Boundary is '$boundary'\n";
+    my $fieldname = "";
+    my $fieldvalue = "";
+
+    # Read the input stream line by line and parse it into a series of parts,
+    # each one containing a single form field and its value and each one
+    # separated from the next by the value of $boundary.
+    my $remaining = $ENV{"CONTENT_LENGTH"};
     while ($remaining > 0 && ($_ = <STDIN>)) {
         $remaining -= length($_);
-#        print DEBUG "< $_";
+
+        # If the current input line is a boundary line, save the previous
+        # form value and reset the storage variables.
         if ($_ =~ m/^-*$boundary/) {
-#            print DEBUG "Entered header\n";
-            $inheader = 1;
-            $itemname = "";
-            next;
-        }
+            if ( $fieldname ) {
+                chomp($fieldvalue);
+                $fieldvalue =~ s/\r$//;
+                if ( defined $::FORM{$fieldname} ) {
+                    $::FORM{$fieldname} .= $fieldvalue;
+		                push @{$::MFORM{$fieldname}}, $fieldvalue;
+                } else {
+                    $::FORM{$fieldname} = $fieldvalue;
+                    $::MFORM{$fieldname} = [$fieldvalue];
+                }
+            }
 
-        if ($inheader) {
+            $inheader = 1;
+            $fieldname = "";
+            $fieldvalue = "";
+
+        # If the current input line is a header line, look for a blank line
+        # (meaning the end of the headers), a Content-Disposition header
+        # (containing the field name and, for uploaded file parts, the file 
+        # name), or a Content-Type header (containing the content type for 
+        # file parts).
+        } elsif ( $inheader ) {
             if (m/^\s*$/) {
                 $inheader = 0;
-#                print DEBUG "left header\n";
-                $::FORM{$itemname} = "";
-            }
-            if (m/^Content-Disposition:\s*form-data\s*;\s*name\s*=\s*"([^\"]+)"/i) {
-                $itemname = $1;
-#                print DEBUG "Found itemname $itemname\n";
+            } elsif (m/^Content-Disposition:\s*form-data\s*;\s*name\s*=\s*"([^\"]+)"/i) {
+                $fieldname = $1;
                 if (m/;\s*filename\s*=\s*"([^\"]+)"/i) {
-                    $::FILENAME{$itemname} = $1;
+                    $::FILE{$fieldname}->{'filename'} = $1;
                 }
+            } elsif ( m|^Content-Type:\s*([^/]+/[^\s;]+)|i ) {
+                $::FILE{$fieldname}->{'contenttype'} = $1;
             }
-            
-            next;
+
+        # If the current input line is neither a boundary line nor a header,
+        # it must be part of the field value, so append it to the value.
+        } else {
+          $fieldvalue .= $_;
         }
-        $::FORM{$itemname} .= $_;
-    }
-    delete $::FORM{""};
-    # Get rid of trailing newlines.
-    foreach my $i (keys %::FORM) {
-        chomp($::FORM{$i});
-        $::FORM{$i} =~ s/\r$//;
     }
 }
 

checksetup.pl

@@ -191,6 +191,7 @@ unless (have_vers("DBD::mysql","1.2209")) { push @missing,"DBD::mysql" }
 unless (have_vers("Date::Parse",0))       { push @missing,"Date::Parse" }
 unless (have_vers("AppConfig","1.52"))    { push @missing,"AppConfig" }
 unless (have_vers("Template","2.01"))     { push @missing,"Template" }
+unless (have_vers("Text::Wrap","2001.0131")) { push @missing,"Text::Wrap" }
 
 # If CGI::Carp was loaded successfully for version checking, it changes the
 # die and warn handlers, we don't want them changed, so we need to stash the

defparams.pl

@@ -679,4 +679,28 @@ DefParam("useattachmenttracker",
          "b",
          0);
 
+# The maximum size (in bytes) for patches and non-patch attachments.
+# The default limit is 1000KB, which is 24KB less than mysql's default
+# maximum packet size (which determines how much data can be sent in a
+# single mysql packet and thus how much data can be inserted into the
+# database) to provide breathing space for the data in other fields of
+# the attachment record as well as any mysql packet overhead (I don't
+# know of any, but I suspect there may be some.)
+
+DefParam("maxpatchsize",
+         "The maximum size (in kilobytes) of patches.  Bugzilla will not 
+          accept patches greater than this number of kilobytes in size.
+          To accept patches of any size (subject to the limitations of 
+          your server software), set this value to zero." ,
+         "t",
+         '1000');
+
+DefParam("maxattachmentsize" , 
+         "The maximum size (in kilobytes) of non-patch attachments.  Bugzilla 
+          will not accept attachments greater than this number of kilobytes 
+          in size.  To accept attachments of any size (subject to the
+          limitations of your server software), set this value to zero." , 
+         "t" , 
+         '1000');
+
 1;