Bug 120537 - Allow the use of a local 'dot' binary to generate dependancy

checksetup.pl

@@ -684,8 +684,7 @@ END
     print "Creating data/webdot/.htaccess...\n";
     open HTACCESS, ">data/webdot/.htaccess";
     print HTACCESS <<'END';
-# Allow access to nothing in this directory except for .dot files
-# and don't allow access to those to anyone except research.att.com
+# Restrict access to .dot files to the public webdot server at research.att.com 
 # if research.att.com ever changed their IP, or if you use a different
 # webdot server, you'll need to edit this
 <FilesMatch ^[0-9]+\.dot$>
@@ -693,6 +692,12 @@ END
   Deny from all
 </FilesMatch>
 
+# Allow access by a local copy of 'dot' to .png, .gif, .jpg, and
+# .map files
+<FilesMatch ^[0-9]+\.(png|gif|jpg|map)$>
+  Allow from all
+</FilesMatch>
+
 # And no directory listings, either.
 Deny from all
 END
@@ -922,7 +927,7 @@ if ($my_db_check) {
     # Check what version of MySQL is installed and let the user know
     # if the version is too old to be used with Bugzilla.
     if ( vers_cmp($sql_vers,$sql_want) > -1 ) {
-        print "ok: found v$sql_vers\n\n";
+        print "ok: found v$sql_vers\n";
     } else {
         die "Your MySQL server v$sql_vers is too old./n" . 
             "   Bugzilla requires version $sql_want or later of MySQL.\n" . 
@@ -958,7 +963,36 @@ my $dbh = DBI->connect($connectstring, $my_db_user, $my_db_pass)
 END { $dbh->disconnect if $dbh }
 
 
+###########################################################################
+# Check GraphViz setup
+###########################################################################
+
+#
+# If we are using a local 'dot' binary, verify the specified binary exists
+# and that the generated images are accessible.
+#
+
+if(-e "data/params") {
+  require "data/params";
+  if( $::param{'webdotbase'} && $::param{'webdotbase'} !~ /^https?:/ ) {
+    printf("Checking for %15s %-9s ", "GraphViz", "(any)");
+    if(-x $::param{'webdotbase'}) {
+      print "ok: found\n";
+    } else {
+      print "not a valid executable: $::param{'webdotbase'}\n";
+    }
+
+    # Check .htaccess allows access to generated images
+    open HTACCESS, "data/webdot/.htaccess";
+    if(! grep(/png/,<HTACCESS>)) {
+      print "Dependency graph images are not accessible.\n";
+      print "Delete data/webdot/.htaccess and re-run checksetup.pl to rectify.\n";
+    }
+    close HTACCESS;
+  }
+}
 
+print "\n";
 
 
 ###########################################################################

defparams.pl

@@ -539,9 +539,41 @@ DefParam("usedependencies",
          1);
 
 DefParam("webdotbase",
-         "This is the URL prefix that is common to all requests for webdot.  The <a href=\"http://www.research.att.com/~north/cgi-bin/webdot.cgi\">webdot package</a> is a very swell thing that generates pictures of graphs.  If you have an installation of bugsplat that hides behind a firewall, then to get graphs to work, you will have to install a copy of webdot behind your firewall, and change this path to match.  Also, webdot has some trouble with software domain names, so you may have to play games and hack the %urlbase% part of this.  If this all seems like too much trouble, you can set this paramater to be the empty string, which will cause the graphing feature to be disabled entirely.",
+         "It is possible to show graphs of dependent bugs. You may set this parameter to
+any of the following:
+<ul>
+<li>A complete file path to \'dot\' (part of <a
+href=\"http://www.graphviz.org\">GraphViz</a>) will generate the graphs
+locally.</li>
+<li>A URL prefix pointing to an installation of the <a
+href=\"http://www.research.att.com/~north/cgi-bin/webdot.cgi\">webdot
+package</a> will generate the graphs remotely.</li>
+<li>A blank value will disable dependency graphing.</li>
+</ul>
+The default value is a publically-accessible webdot server.",
          "t",
-         "http://www.research.att.com/~north/cgi-bin/webdot.cgi/%urlbase%");
+         "http://www.research.att.com/~north/cgi-bin/webdot.cgi/%urlbase%",
+         \&check_webdotbase);
+
+sub check_webdotbase {
+    my ($value) = (@_);
+    $value = trim($value);
+    if ($value eq "") {
+        return "";
+    }
+    if($value !~ /^https?:/) {
+        if(! -x $value) {
+            return "The file path \"$value\" is not a valid executable.  Please specify the complete file path to 'dot' if you intend to generate graphs locally.";
+        }
+        # Check .htaccess allows access to generated images
+        open HTACCESS, "data/webdot/.htaccess";
+        if(! grep(/png/,<HTACCESS>)) {
+            print "Dependency graph images are not accessible.\nDelete data/webdot/.htaccess and re-run checksetup.pl to rectify.\n";
+        }
+        close HTACCESS;
+    }
+    return "";
+}
 
 DefParam("entryheaderhtml",
          "This is a special header for the bug entry page. The text will be printed after the page header, before the bug entry form. It is meant to be a place to put pointers to intructions on how to enter bugs.",

showdependencygraph.cgi

@@ -163,13 +163,21 @@ node [URL="${urlbase}show_bug.cgi?id=\\N", style=filled, color=lightgrey]
     close DOT;
     chmod 0777, $filename;
     
+    my $webdotbase = Param('webdotbase');
+    if($webdotbase =~ /^https?:/) {
         my $url = PerformSubsts(Param("webdotbase")) . $filename;
-
         print qq{<a href="$url.map"> <img src="$url.gif" ismap> </a><hr>\n};
+    } else {
+        my $pngfilename = "data/webdot/$$.png";
+        my $mapfilename = "data/webdot/$$.map";
+        system("$webdotbase","-Tpng","-o","$pngfilename","$filename");
+        system("$webdotbase","-Timap","-o","$mapfilename","$filename");
+        print qq{<a href="$mapfilename"> <img src="$pngfilename" ismap> </a><hr>\n};
+    }
   
     # Cleanup any old .dot files created from previous runs.
     my $since = time() - 24 * 60 * 60;
-    foreach my $f (glob("data/webdot/*.dot")) {
+    foreach my $f (glob("data/webdot/*.dot data/webdot/*.png data/webdot/*.map")) {
         # Here we are deleting all old files. All entries are from the
         # data/webdot/ directory. Since we're deleting the file (not following
         # symlinks), this can't escape to delete anything it shouldn't