Page MenuHomePhabricator

Upgrade XHGui from 0.8.x to 0.9
Closed, ResolvedPublic


Subset of changes from

  • [14e2e0d] Add support for tideways_xhprof (in addition to legacy "tideways").
  • [ac0848a] Add web-based method for uploading profiles.
  • [0bd1fbd] Add web-based delete method for deleting profiles.
  • [28ce4f6] Fix compatibility problem with cursor on MongoDB 3.5+.
  • [99c228c] Fix another mandatory 'cursor' issue with MongoDB 3.5.

Good things:

  • MongoDB 3.5 support (relevant for this task, as webperf1002 is running a newer Mongo than tungsten).
  • Broken flamegraph views have been removed.


  • There are public web-facing APIs for uploading and deleting profiles.

Given our install is public, we probably need to disable these. I'll see what it's like after the upgrade and either configure or revert as needed.

Event Timeline

Krinkle triaged this task as Medium priority.Dec 20 2018, 10:43 PM
Krinkle created this task.

I've upgraded XHGUi from 0.8.0 to 0.9.0-d5e9bd94 (see the commit).

I'll let puppet will auto-deploy this in a few minutes.

And indeed, the write actions were publicly exposed for a few seconds, and I was stupid enough to click on it. To my surprise, it didn't even have a confirmation dialog or interstitial, it just wiped it all.

I guess we don't use the permalinks very often long-term, but would've preferred to keep those records.

Reported upstream at

Local patch applied at