vBug Tracker Lite 3.5.1

[high]The XSS security flaw reported in this modification has been fixed by Staff and a new zip file (3.5.1a) uploaded.[/high]

Here is a port of my vBug Tracker hack from vb 3.0.x. This mimics the Bug Tracker found at vBulletin.

Details:

• 7 - table additions
  96 - Phrases Added
  3 - file additions
  2 - xml files
  8 - template additions
  3 - Plugins

Please click install for support! For those interested, the Pro version is in development and should be out soon. It will be released at vb-scripts.com.

Sept 25, 2005
Bug fixes:

• * Added Missing phrases for editing status, type & severity.
  * Fixed bug in changing displayorder

Sept 26, 2005
Bug Fixes/Changes

• * Fixed bugcache issue and tested
  * Added admin usergroup permissions

Sept 27, 2005 (Part 1)
Bug Fixes:

• * Fixed subscribe issues and missing phrases.

Sept 27, 2005 (Part 2)

• * Complete rewrite of the subscription piece including the unsubscribe.
  * Subscriptions fully tested and working from all aspects!

Nov 7, 2005

• * Fixed missing table prefix when editing status.
  * Fixed issue when editing severities.
  * Now supports secondary usergroups.

Nov 24, 2005

• * Fixed extra span tag in list template.
  * Fixed searching on version.
  * Added "unassigned" to dropdown.

Jul 11, 2006

• * XSS Flaw fixed by Staff.

To upgrade:

Import the product xml and select "Allow Overwrite".
Upload all the files overwriting the old ones.

Lastly... Please follow the instructions exactly as they are outlined in the documents/install.txt and in the order as listed to avoid any problems.

Updated for vBulletin 3.7, Get it here

[precharge]

Would like regular users to be able to submit bugs but not view them. The only way they seem to be able to add is to have view access. Is there a fix to this?

[Trevor Hannant]

Has anyone requested a 3.6 version of this?

[MThornback]

Originally Posted by jluerken

It has problems since vb3.6 with those lines in vbugs.php

PHP Code:

foreach ($bugcache['severity'] as $key => $entry) {
  $selected = iif($vbulletin->GPC['vbug_severityid'] == $key, 'selected="selected"');
  $val = $entry['title'];
  eval('$severitybits .= "' . fetch_template('userfield_select_option') . '";');
}
foreach ($bugcache['type'] as $key => $entry) {
  $selected = iif($vbulletin->GPC['vbug_typeid'] == $key, 'selected="selected"');
  $val = $entry['title'];
  eval('$typebits .= "' . fetch_template('userfield_select_option') . '";');
}
foreach ($bugcache['version'] as $key => $entry) {
  $selected = iif($vbulletin->GPC['vbug_versionid'] == $key, 'selected="selected"');
  $val = $entry['title'];
  eval('$versionbits .= "' . fetch_template('userfield_select_option') . '";');
}
foreach ($bugcache['status'] as $key => $entry)
{
        $statuscount = $db->query_first("
        SELECT count(*) AS status
        FROM " . TABLE_PREFIX . "vbug
        WHERE vbug_statusid = $key
        ");
  $numstatuses = $statuscount['status'];
  $selected = iif($vbulletin->GPC['vbug_statusid'] == $key, 'selected="selected"');
  $val = $entry['title']. " (" .$numstatuses. ")";
  eval('$statusbits .= "' . fetch_template('userfield_select_option') . '";');
} 


The foreeach statement is wrong but I am not a programer to say what has changes with 3.6 and how those lines need to look now.

Attached is our work around....it suppressed the errors...dunno if its a 100% fix

[jluerken]

Originally Posted by MThornback

Attached is our work around....it suppressed the errors...dunno if its a 100% fix

Loool oh no. A few hours to late. Now I spend money for this
http://www.visionscripts.com/?page=p...vsproductid=10

[akanevsky]

Originally Posted by jluerken

Loool oh no. A few hours to late. Now I spend money for this
http://www.visionscripts.com/?page=p...vsproductid=10

That was a good investment though. You won't regret it.

[Adrian Schneider]

I switched to Mantis and I am very pleased with it.

[akanevsky]

Mantis has no vBulletin integration. Which makes it great for other purposes, but not for vBulletin developers / designers.

[Zelda-King]

Originally Posted by MThornback

Attached is our work around....it suppressed the errors...dunno if its a 100% fix

One error less;

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 570

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 575

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 585

[Delphiprogrammi]

you don't need to modify any source files to get this working with 3.6.x .If you import the product and goto the tracker page (vbugs.php) then you will get those foreach() errors Zelda-King posted above.

open the product xml and you will see it trys to run an INSERT query on the datastore table (actually 2 of them) but the product disables database errors sow if anything goes wrong MySQL won't show you anything

the datastore for the bugcache will fail and that is why you get that foreach() errors (it is missing in the database)

you can manually query your database to add it and then this will work fine...

one question left is it safe to use ?

[Zelda-King]

You mean this?

$db->query_write("INSERT INTO " . TABLE_PREFIX . "datastore VALUES ('vbug_version', 's:5:\"3.5.1\"')");
			$db->query_write("INSERT INTO " . TABLE_PREFIX . "datastore VALUES ('bugcache', 'a:4:{s:6:\"status\";a:12:{i:1;a:2:{s:5:\"title\";s:11:\"Unconfirmed\";s:12:\"displayorder\";s:1:\"1\";}i:2;a:2:{s:5:\"title\";s:9:\"Confirmed\";s:12:\"displayorder\";s:1:\"2\";}i:3;a:2:{s:5:\"title\";s:14:\"Closed (Fixed)\";s:12:\"displayorder\";s:1:\"3\";}i:4;a:2:{s:5:\"title\";s:9:\"Duplicate\";s:12:\"displayorder\";s:1:\"4\";}i:5;a:2:{s:5:\"title\";s:17:\"Awaiting Feedback\";s:12:\"displayorder\";s:1:\"5\";}i:6;a:2:{s:5:\"title\";s:5:\"Bogus\";s:12:\"displayorder\";s:1:\"6\";}i:7;a:2:{s:5:\"title\";s:20:\"Closed (No Response)\";s:12:\"displayorder\";s:1:\"7\";}i:8;a:2:{s:5:\"title\";s:19:\"Working As Designed\";s:12:\"displayorder\";s:1:\"8\";}i:9;a:2:{s:5:\"title\";s:17:\"Browser Bug/Issue\";s:12:\"displayorder\";s:1:\"9\";}i:10;a:2:{s:5:\"title\";s:9:\"Won''t Fix\";s:12:\"displayorder\";s:2:\"10\";}i:11;a:2:{s:5:\"title\";s:12:\"Design Issue\";s:12:\"displayorder\";s:2:\"11\";}i:12;a:2:{s:5:\"title\";s:11:\"Style Issue\";s:12:\"displayorder\";s:2:\"12\";}}s:8:\"severity\";a:4:{i:1;a:2:{s:5:\"title\";s:7:\"Trivial\";s:12:\"displayorder\";s:1:\"1\";}i:2;a:2:{s:5:\"title\";s:5:\"Minor\";s:12:\"displayorder\";s:1:\"2\";}i:3;a:2:{s:5:\"title\";s:5:\"Major\";s:12:\"displayorder\";s:1:\"3\";}i:4;a:2:{s:5:\"title\";s:8:\"Critical\";s:12:\"displayorder\";s:1:\"4\";}}s:4:\"type\";a:12:{i:1;a:2:{s:5:\"title\";s:3:\"Bug\";s:12:\"displayorder\";s:1:\"1\";}i:2;a:2:{s:5:\"title\";s:4:\"ToDo\";s:12:\"displayorder\";s:1:\"2\";}i:3;a:2:{s:5:\"title\";s:15:\"Feature-Request\";s:12:\"displayorder\";s:1:\"3\";}i:4;a:2:{s:5:\"title\";s:8:\"Admin CP\";s:12:\"displayorder\";s:1:\"4\";}i:5;a:2:{s:5:\"title\";s:28:\"Integration (Calendar/Forum)\";s:12:\"displayorder\";s:1:\"5\";}i:6;a:2:{s:5:\"title\";s:20:\"Installation/Upgrade\";s:12:\"displayorder\";s:1:\"6\";}i:7;a:2:{s:5:\"title\";s:17:\"Language/Phrasing\";s:12:\"displayorder\";s:1:\"7\";}i:8;a:2:{s:5:\"title\";s:9:\"Templates\";s:12:\"displayorder\";s:1:\"8\";}i:9;a:2:{s:5:\"title\";s:9:\"Leader CP\";s:12:\"displayorder\";s:1:\"9\";}i:10;a:2:{s:5:\"title\";s:15:\"General/Unknown\";s:12:\"displayorder\";s:2:\"10\";}i:11;a:2:{s:5:\"title\";s:5:\"Email\";s:12:\"displayorder\";s:2:\"11\";}i:12;a:2:{s:5:\"title\";s:10:\"Suggestion\";s:12:\"displayorder\";s:2:\"12\";}}s:7:\"version\";a:1:{i:1;a:2:{s:5:\"title\";s:4:\"Test\";s:12:\"displayorder\";s:1:\"1\";}}}')");