There is a GPL PHP software https://github.com/EvanOman/KanbanBoard which uses a custom field in Bugzilla to track the column of the bug.

An intern at Mozilla coded an Angular.js with a python backend which does Kanban as well: https://github.com/DerekRies/kanbanzilla

For hhvm project purposes, maybe we can just stick to mingle which is already used by various teams and the base of the scrum of scrums.

(In reply to Ori Livneh from comment #0)

We're considering using TargetProcess's KanBan board

Who's "we" in this context?

tp2.cgi says

my $supportedBugzillaVersion = '4.2';

But we run 4.4. ("we" = the Wikimedia servers ;-)

As it's written, it does a very poor job of security. They parameterize most of their sql (except the one on 376, but hopefully bugzilla wouldn't have an extra feature name that contained sql), so it probably won't take down the server.

They don't do any xss filtering, and rely and outputting text/plain content type. So xss is only exploitable on ie6, iOS 6's Safari, or any other browser that interprets scripts in text/plain.

It would probably be safe to deploy this if you could lock down access to only their IP address (so xss wouldn't be an issue). But it certainly isn't something I would feel comfortable having up and accessible on our servers.

Is this still wanted, or can this ticket be closed?

Setting to "Lowest" for now, and when we migrate to Phabricator, let's close this as INVALID (ie: keep it around on the very very slim chance something in Phabricator land blows up and we don't end up using it).