[PATCH] bugzilla: support Bugzilla 4.4.3+ API login token authentication (issue4257)

[Jim Hague]

On Monday 26 May 2014 17:00:12 Matt Mackall wrote:
> Technically, this is a regression for Bugzilla (we broke all our
> clients!) but a feature for us (we added 4.4.3 support!). So it's not
> 100% appropriate for OUR stable branch..

Granted. I wasn't sure whether to go for stable or not.

> Are we sure this is safe against older Bugzilla?

I don't have a large selection of older Bugzillas to test against. I've tried 
it against 4.2.5, and it's fine. The additional new argument to the Bugzilla 
API calls is just ignored. I've checked the source for 3.4.13 and unrecognised 
arguments are ignored there, too, so I'm pretty confident it's safe.

The patch is the minimal possible. If I could drop XMLRPC support for Bugzilla 
3.4, I could rework to pass user/pass on each API call and remove the horrible 
hack for supporting cookies in XMLRPC transports. This would work on all 
Bugzilla from 3.6 onwards. 3.6 has been out of support for some time. 

Mind you, if allowed to drop support for 3.4, I'd first nuke the older access 
methods that go direct to the database.
-- 
Jim Hague - jim.hague at acm.org          Never trust a computer you can't lift.