MantisBT 2.23.0 and 2.22.2 released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

MantisBT 2.23.0

Note that this release includes a schema change. Do not forget to upgrade the database as documented in the Admin Guide.

  • 26139: [reports] Move MantisGraph pages to their own tab (dregad)
  • 26374: [api rest] Update GuzzleHttp from 6.3.3 to 6.4.1 (dregad)
  • 22817: [attachments] “private bugnotes” as default setting prevents uploading further attachments (vboctor)
  • 24113: [attachments] Attaching files to a note creates a second note with only the attachments (vboctor)
  • 24577: [attachments] Deleting a note, should delete associated attachments (vboctor)
  • 25935: [attachments] Warning for users when making public notes with attachments private (vboctor)
  • 25960: [attachments] Add files information to EVENT_BUGNOTE_ADD event (vboctor)
  • 25972: [custom fields] Use custom field regular expression in the html input (cproensa)
  • 25975: [custom fields] Manage custom fields page does not show fields in order (cproensa)
  • 26081: [attachments] Switching note to private/public, should impact associated attachments (vboctor)
  • 26083: [auditing] Link attachments issue history events to attachments to determine visibility (vboctor)
  • 10107: [feature] Allow setting reminder bugnotes’ view status (dregad)
  • 21712: [filters] No way to filter “negative” for checkbox custom fields (cproensa)
  • 21733: [attachments] Attachments should be linkable to notes in db (vboctor)
  • 21799: [documentation] Wrong data types in ERD (dregad)
  • 25902: [api rest] Implement IssueViewPageCommand to separate logic from rendering of issue view page (vboctor)
  • 25905: [ui] Inline actions user experience is inconsistent between different features (syncguru)
  • 26062: [filters] Filter for a date custom field fails when no values for this field exists (cproensa)
  • 26092: [documentation] Invalid URL for GraphViz home page (dregad)
  • 26093: [plug-ins] Content Security Policy directive ‘frame-ancestors’ contains an invalid source when http_csp_add is called for it (dregad)
  • 26094: [bugtracker] PHP notice in bug view page when viewing issue without category (dregad)
  • 26098: [documentation] Update ERD diagram to reflect new field in bug_file table (dregad)
  • 26132: [time tracking] Application Error 401 when clicking Time Tracking at the bottom of a bug notes page (dregad)
  • 26134: [time tracking] Bugnotes time spent info is always shown even if time tracking is disabled (dregad)
  • 9802: [attachments] Support attachments associated with private notes (vboctor)
  • 26128: [ui] Attachments displayed with empty user (dregad)
  • 9363: [attachments] Comments on attachments (vboctor)
  • 26195: [api rest] Error requesting issues using saved filter (cproensa)
  • 26082: [attachments] Create a place holder note when submitting attachments without text (vboctor)
  • 26002: [email] “Email on monitoring” not configurable in manage_config_email_page (cproensa)
  • 26095: [attachments] Support inline playing of audio attachments (vboctor)
  • 26096: [documentation]preview_*_extensions config options not documented (vboctor)
  • 26102: [attachments] Support inline playing of video attachments (vboctor)
  • 26109: [db postgresql] check_pgsql_bool_columns: check wrongly suggests that the redirect_delay should be in boolean format (dregad)
  • 26123: [ui] Both “monitor” and “end monitoring” buttons are displayed (dregad)
  • 26125: [ui] “Users monitoring this issue” section not shown if nobody is monitoring the issue (dregad)
  • 26141: [custom fields] Use max length property of custom field in inputs (cproensa)
  • 26166: [performance] Issue view api uses many custom field database queries (cproensa)
  • 26167: [performance] Issue view history api repeated calls to bug_get_attachments database query (cproensa)
  • 26295: [ui] Clone button is not displayed correctly (cproensa)
  • 26326: [bugtracker] Tags are not copied from master issue when cloning (community)
  • 26265: [email] Bump phpmailer/phpmailer from 6.0.7 to 6.1.3 (dregad)
  • 26353: [tagging] Tag attachments list includes tags already attached to the bug (dregad)
  • 26368: [administration] Custom fields selector in manage project page are not ordered by name (cproensa)
  • 26030: [custom fields] Filter value “none” is not available for multiselection list custom fields (cproensa)
  • 26086: [api rest] Update Slim Framework to 3.12.3 (dregad)
  • 26119: [tagging] Add $g_tag_create_threshold to Workflow Thresholds in the GUI (dregad)
  • 26150: [bugtracker] Closing issues via group action with empty note creates a bugnote record (vboctor)
  • 26294: [ui] Attachments without note text are not displayed (cproensa)
  • 26358: [security] Vulnerability from library Moment.js 2.15.2 (dregad)
  • 26367: [administration] Use empty value as default project in “manage project” subproject section (cproensa)
  • 26382: [javascript] Update corejs-typeahead.js library to 1.3.0 (dregad)
  • 26388: [security] Update ADOdb to 5.20.15 (dregad)

MantisBT 2.22.2

Maintenance release for 2.22.x series.

  • 26351: [preferences] Field “EXCEL columns” has space or tabulation (dregad)

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

MantisBT 2.22.1 and 1.3.20 released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

MantisBT 2.22.1

Security release for 2.22.x series. All installations are strongly advised to upgrade as soon as possible.

  • 0026091: [security] CVE-2019-15715: [Admin Required – Post Authentication] Command Execution / Injection Vulnerability (atrol)
  • 0026110: [administration] [Show content] for Complex Configuration option doesn’t work when mod_rewrite is disabled (dregad)
  • 0026160: [security] Update bundled Bootstrap to 3.4.1 (CVE-2019-8331) (dregad)
  • 0026168: [security] Enable integrity hashes for CSS ressources from CDNs (dregad)

MantisBT 1.3.20

Security release for 1.3.x series. All installations are strongly advised to upgrade as soon as possible.

  • 0026162: [security] CVE-2019-15715: Command Execution / Injection Vulnerability (dregad)

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

MantisBT 2.22.0 Released

In order to stay up to date with the latest MantisBT news and participate in our polls, please follow us on twitter, star our github repository, and retweet to spread the word!

MantisBT 2.22.0

A feature release including functional improvements and bug fixes, 2.22.0 also marks the end of Internet Explorer 11 support.

  • 0029198: [installation] End of Internet Explorer 11 support (dregad)
  • 0026078: [security] CVE-2019-15539: Stored XSS on Project Documentation (atrol)
  • 0006128: [bugtracker] Ability to add monitors to a bug when the bug is first reported (dregad)
  • 0025162: [plug-ins] Improve plugin schema upgrade error message (dregad)
  • 0025470: [api soap] SOAP API return value does not match definition in WSDL (dregad)
  • 0025749: [bugtracker] error_string() does not allow HTML tags inside of error messages (dregad)
  • 0025774: [installation] Reflect PHP requirements in Composer config (dregad)
  • 0025784: [html] Invalid HTML in manage_config_workflow_page.php (dregad)
  • 0025815: [bugtracker] Users can’t add monitors if access < show_monitor_list_threshold and >= monitor_add_others_bug_threshold (dregad)
  • 0025826: [administration] Impossible to set add/remove monitors thresholds from manage page (dregad)
  • 0025827: [documentation] Improve documentation for monitors-related configs (dregad)
  • 0025848: [code cleanup] Remove get_email_link() API function (dregad)
  • 0025849: [code cleanup] New prepare_mailto_url() API function (dregad)
  • 0025850: [bugtracker] PHP Notices in User API (dregad)
  • 0025851: [printing] Remove hyperlinks on usernames in Word export (dregad)
  • 0021797: [attachments] Add support for pasting images as attachments (syncguru)
  • 0022898: [security] Email for a new private bugnote was send to a non authorized reporter (dregad)
  • 0023725: [time tracking] Time tracking box rendering is broken (syncguru)
  • 0024189: [bugtracker] Status color squares become black (cproensa)
  • 0024441: [tagging] Report issue doesn’t support multiple new tags (dregad)
  • 0024590: [plug-ins] Add EVENT_MENU_MAIN_FILTER to allow complete customisation of main menu (dregad)
  • 0025362: [api rest] REST API support for multiple authorization headers (community)
  • 0025686: [bugtracker] Replace mailto: by link to user profile page in view.php (dregad)
  • 0025839: [html] Leading newlines disappear when editing data in textarea elements (dregad)
  • 0025894: [code cleanup] Remove unused $p_can_report_only parameter in layout_navbar_projects_list() (dregad)
  • 0025904: [documentation] Admin guide: remove reference to unmaintained Firefox add-on (dregad)
  • 0025910: [administration] Simplify displaying of complex values in adm_config_report page (cproensa)
  • 0025911: [javascript] Improve client-side sortable tables script (cproensa)
  • 0025914: [plug-ins]EVENT_BUGNOTE_DATA event not documented in developer manual (dregad)
  • 0025951: [plug-ins] MantisGraph: update Chart.js library to v2.8.0 (dregad)
  • 0025952: [code cleanup] MantisGraph: define Chart.js-related constants in the plugin (dregad)
  • 0025953: [plug-ins] Missing an API function to check if a plugin event has been declared (dregad)
  • 0025961: [tools] PHPUnit tests as run by Travis CI builds do not execute all defined suites (dregad)
  • 0025962: [bugtracker] IssueAddCommand does not create history entries identical to the code it replaced (vboctor)
  • 0025963: [ui] Gravatar plugin should always use https (vboctor)
  • 0025969: [other] bug_report_page is forced to be cached (cproensa)
  • 0025996: [api rest] Missing tag name in error message when creating issue via REST API (dregad)
  • 0025997: [api rest] Invalid JSON response when creating issue with tag by name via REST API (dregad)
  • 0026063: [code cleanup] Glue after String Array is being Deprecated (dregad)
  • 0026066: [plug-ins] Gravatar Plugin Description (atrol)
  • 0026074: [tagging] Creating an invalid tag should fail with an error (dregad)
  • 0026075: [tagging] Tag-related error messages should reference the tag’s name (dregad)
  • 0026076: [api rest] Adding issue via REST API should fail if requested tags can’t be attached (dregad)
  • 0026077: [api rest] IssueAddCommand should create tag specified by name if they do not exist (dregad)

Go ahead and download the release from our website.

MantisBT 2.21.2 released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

MantisBT 2.21.2

Security release for 2.21.x series. All installations are strongly advised to upgrade as soon as possible.

  • 0025995: [security] CVE-2019-15074: Stored XSS Vulnerability in Timeline (dregad)

Go ahead and download the release from our website.

MantisBT 2.21.1 released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

MantisBT 2.21.1

Maintenance release for 2.21.x series.

  • 0025722: [administration] Wrong access_level settings when updating rights in the project admin page (cproensa)
  • 0025734: [administration] LOGFILE_NOT_WRITABLE error triggered if file does not exist (dregad)
  • 0025742: [other] Summary “By Date (days)” gets wrong number (cproensa)
  • 0025763: [attachments] File upload timeout (atrol)
  • 0025781: [reports] Summary statistics db error message (cproensa)
  • 0025783: [administration] Button label truncated on manage_config_workflow_page (dregad)

Go ahead and download the release from our website.