MantisBT - Issues

0019370: Retire 'user_print_pref' table and related code

Fri, 29 May 2026 20:42:06 -0400

Seems like a table that was used to select columns to show in print page. We now have a different model for customizing columns across all features.

0008685: New users aren't warned that another user account has identical e-mail address.

Fri, 29 May 2026 08:16:37 -0400

In large corporate environments, users sometimes register once, then forget they have done so and later register another account with the same e-mail address. This leads to duplicate, unwanted accounts on the system.

I recommend that Mantis should warn users when they try to register another account with the same e-mail address, or, at the administrator's option, refuse to register such a duplicate account at all.

0037182: A way to see all users without any activity

Fri, 29 May 2026 06:23:23 -0400

Hi,

On the Users page (https://bugs.xdebug.org/manage_user_page.php), it is possible to see all users that never logged in (Unused), or are New. I would like there to be a additional tab for users that never had any activity (no bugs, notes, attachments, or monitored issues).

I have created a patch for that, which I have attached. It's my first one, so please be kind. I also don't know if I missed any other possible activities, but these can be easily added.

If this seems suitable, I can also provide some translations.

cheers,
Derick

0037110: New translation: serbo-croatian (latin)

Thu, 28 May 2026 12:26:43 -0400

A new language file has been committed by TranslateWiki.net on on Nov 3, 2025 (see :mantisbt:b5803c2d264bec9ad8d5630ff36d9ed140506338:)

Problem: the language file does not follow our naming convention.
* Current: `strings_sh-latn.txt‎`
* Expected: `strings_serbo-croatian_latin.txt‎` (or something similar).

The problem has been reported upstream:
https://translatewiki.net/wiki/Support#MantisBT_new_language_'sh-latn'

Once fixed, it should be added to *$g_language_choices_arr*.

0032861: Implement IssueUpdateCommand

Mon, 25 May 2026 11:54:48 -0400

Implement IssueUpdateCommand and use it from the appropriate places in the code.

There are discrepancies between issue updates from the GUI vs the API, as bug_udpate.php has not been kept in sync with mc_issue_update(). One confirmed case is the latter does not check for child relationships when resolving an issue (see https://github.com/mantisbt/mantisbt/pull/1906#issuecomment-1693602387).

0037144: Optional plugin dependencies are not displayed

Mon, 25 May 2026 11:54:46 -0400

The `manage_plugin_page.php` page does not display information about optional plugin dependencies.
Having complete information about plugins would be useful for administrators, particularly when a new dependency appears in an updated version of a plugin.

0037134: The "Jump to bug" form should accept bug_id with leading `#`

Mon, 25 May 2026 08:09:06 -0400

Currently, the form only accepts integer values, causing an error to be thrown f the user enters `#1234` in the search field, which sometimes happen when copy/pasting e.g from a Git commit message.

As a convenience, we should also allow integers prefixed by the configured tag ($g_bug_link_tag, `#` by default).

0037118: The login page allows users to enter only blank spaces in the username field and proceeds instead of validating the input.

Mon, 25 May 2026 07:00:06 -0400

When a user enters only blank spaces in the username field and tries to log in with any password, the system does not display any validation error and processes the request. This may lead to unexpected behavior and reduces the overall security and input validation of the application.

0037120: When the submit button is clicked multiple times quickly on the Report Issue page, the system creates duplicate issue entries.

Mon, 25 May 2026 06:59:36 -0400

On the Report Issue page, if a user clicks the Submit Issue button multiple times before the page refreshes or confirmation appears, the system creates multiple duplicate issues. This affects data integrity and increases unnecessary duplicate records.

0037119: The search functionality does not validate special characters and displays an irrelevant error message instead of handling it pr

Mon, 25 May 2026 06:59:11 -0400

When special characters are entered in the search box, the system throws an irrelevant error message instead of validating the input or showing proper search results. This affects usability and user experience.

0037133: The buttons on the “Access Denied” widget may contain incorrect links

Sun, 24 May 2026 15:15:19 -0400

For example, the “/admin/login_page.php?return=admin%2Findex.php” is converted to “admin/login_page.php?return=admin%2Findex.php” for "Login" button.

0037180: dsng장애

Sun, 24 May 2026 03:46:40 -0400

0037146: Difficult to use the Mantis Graph plugin from within other plugins

Thu, 21 May 2026 12:56:12 -0400

The Mantis Graph plugin offers a variety of useful features for displaying charts in a simple way. This encourages developers of other plugins to take advantage of this free functionality and add Mantis Graph as one of their dependencies.

However, developers have to manually include the `MantisGraph.js` file in their code because the Mantis Graph plugin does not provide an easy way to load it automatically, despite the file being included in the plugin.

0036874: Support CDN in require_js and require_css functions

Thu, 21 May 2026 12:54:38 -0400

MantisBT has `require_js()` and `require_css()` functions designed to generate lists of external scripts and styles for subsequent inclusion in the HTML document header when it is output. However, these functions only support local links. Support for CDN links will allow to conveniently include headers directly on the pages where specific scripts and styles are needed. If this proposal is implemented, it will be possible to optimize pages with dropzone.js and bootstrap-datetimepicker.js scripts, as well as Viz.js.

0034888: Category does not exist error on Issue Trends

Tue, 19 May 2026 11:57:48 -0400

When the Issues Trend by category page processes an Issue without a category, an error is thrown even though this is a normal scenario when $g_allow_no_category = ON

0037136: Replace deprecated strftime() with date() in MantisGraph Period class

Mon, 18 May 2026 04:52:18 -0400

The Period class in the MantisGraph plugin uses strftime() to format
period start/end boundaries. strftime() was deprecated in PHP 8.1 and
removed in PHP 9.0, so it emits deprecation notices on PHP 8.1+ and
will fatal on PHP 9.0.

Replace all strftime() calls in plugins/MantisGraph/core/Period.php
with equivalent, output-preserving date() calls:

- '%Y-%m-%d 23:59:59' -> 'Y-m-d 23:59:59'
- '%Y-%m-%d 00:00:00' -> 'Y-m-d 00:00:00'
- '%Y-%m-%d' -> 'Y-m-d'

Affected methods: a_week(), a_month(), month_to_date(), a_quarter(),
quarter_to_date(), a_year(), year_to_date(), get_start_formatted(),
get_end_formatted().

0034829: Graph plugin: deprecated strftime() in View Issues > issue trends

Mon, 18 May 2026 04:52:18 -0400

view issues > issue trends > drop list select the date

DEPRECATED: 'Function strftime() is deprecated' in '...\xampp\htdocs\mantis\plugins\MantisGraph\core\Period.php' line 192
DEPRECATED: 'Function strftime() is deprecated' in '...\xampp\htdocs\mantis\plugins\MantisGraph\core\Period.php' line 193
DEPRECATED: 'Function strftime() is deprecated' in '...\xampp\htdocs\mantis\plugins\MantisGraph\core\Period.php' line 249
DEPRECATED: 'Function strftime() is deprecated' in '...\xampp\htdocs\mantis\plugins\MantisGraph\core\Period.php' line 258

when selec arbitrary date, the field cannot be keyed in

0037135: Fix CSRF validation failure in anonymous login

Mon, 18 May 2026 03:03:25 -0400

## Summary

The "Login Anonymously" entry point (`login_anon.php`) dead-ends on
`APPLICATION ERROR #2800` (form security token invalid), making
anonymous login via the UI-exposed link unusable.

## Root cause

`login_anon.php` builds its parameters and redirects **directly to
`login.php`**, bypassing `login_page.php` where the `login` CSRF token
is normally generated and seeded into the session. `login.php` calls
`form_security_validate( 'login' )` **unconditionally**, so the
anonymous redirect always fails with ERROR #2800.

0019307: Possibility to report violations of the Content-Security-Policy

Sat, 16 May 2026 12:56:24 -0400

By enabling a new option there should be added a "report-uri"-directive to the CSP-Header.
This feature would help solving problems with Mantis Content-Security-Policy like current bug 0017491.

0037132: UI renders incorrectly in CSS1Compat mode after removing UTF-8 BOM; works only in BackCompat/quirks mode

Sat, 16 May 2026 12:54:56 -0400

Hello,

after enabling and testing the REST API in MantisBT 2.28, I found an issue related to page rendering mode.

Environment:
- MantisBT version: 2.28
- Web server: nginx + PHP-FPM
- Browser: Chrome
- REST API enabled with:
$g_webservice_rest_enabled = ON;

Problem:
The REST API initially failed with:

RuntimeException: Unexpected data in output buffer. Maybe you have characters before an opening in /vendor/slim/slim/Slim/App.php

After investigation, I found that config/custom_strings_inc.php contained a UTF-8 BOM at the beginning of the file.

With BOM present:
- REST API fails with the Slim output buffer error.
- Main UI visually renders correctly.
- document.compatMode in Chrome returns:
BackCompat
- The HTML response starts with several BOM bytes before :
ef bb bf ef bb bf ... 3c 21 44 4f 43

After removing BOM:
- REST API works correctly.
- HTML starts correctly with:

- document.compatMode returns:
CSS1Compat
- However, the MantisBT UI becomes visually broken, as if styles/layout are not applied correctly.

I tested the following:
- Removed BOM from custom_strings_inc.php.
- Verified that the response starts with .
- Verified that REST API works after removing BOM.
- Disabled plugins.
- Disabled custom_strings_inc.php.
- Commented custom status configuration.
- CSS files are loaded with HTTP 200.
- css/status_config.php returns text/css and valid CSS.
- PHP syntax check for custom_strings_inc.php reports no errors.
- The issue still occurs in CSS1Compat mode.
- As a temporary workaround, removing/commenting the output in core/html_api.php forces BackCompat mode and the UI renders correctly while REST API continues to work.

Expected result:
MantisBT UI should render correctly with:
- no UTF-8 BOM in PHP files,
- present as the first output,
- document.compatMode = CSS1Compat,
- REST API working normally.

Actual result:
The UI appears broken in CSS1Compat mode, but renders correctly in BackCompat mode.

Temporary workaround:
Remove/comment output in core/html_api.php to force BackCompat mode. This avoids using BOM and does not break REST API, but it is not a proper fix.

Question:
Is this a known issue in MantisBT 2.28, or is there any configuration/CSS setting required to make the UI render correctly in CSS1Compat mode?

0022144: Check content of configuration files

Sat, 16 May 2026 12:54:56 -0400

Bad contents of files like config_inc.php, custom_strings_inc.php and custom_constants.php can lead to curious problems, e.g. 0022141

This is typically caused by
- wrong encoding (UTF-8 with BOM) or
- content (e.g. white space before first open PHP tag, white space after not needed closing PHP tag at the end of the file)

In addition to the documentation 0022143 we should add checks at least when running admin/check/index.php, maybe also when running the upgrade scripts.

A simple check that the first byte of the files contains character "<" would cover two of the mentioned cases.

0036873: When creating or updating a user, the email address and real name are not synchronized with LDAP

Thu, 14 May 2026 14:15:41 -0400

There are two cases:

1. When a user is created, the database is not initially populated with their email address and real name from LDAP.

2. When updating a user who is not present in LDAP, their email and real name are cleared.

0036832: Strict verification of parameters in translation strings is required

Thu, 14 May 2026 14:13:57 -0400

MantisBT uses language strings that may contain parameters, such as "%1$s." These parameters may be set incorrectly in translated languages, resulting in PHP errors when attempting to display them. It is quite difficult for translators to check for such errors.

0037018: The `require_once()` function is called more times than necessary when loading the API.

Thu, 14 May 2026 14:12:39 -0400

While investigating issue 0036819, I discovered that the `require_api()` function calls `require_once()` more often than necessary, and even recursively.

For example, 63 files are loaded from the API via 88 calls for the file `my_view_page.php`, even though there should obviously only be 63. This process involves 716 calls to the `require_api()` function.

0034465: Wrong rendering of strings

Thu, 14 May 2026 14:09:54 -0400

Most of the string values are rendered wrong if the values contain one of the html tags configured in `$g_html_valid_tags_single_line` .
E. g. with standard settings of `$g_html_valid_tags_single_line`, `field` will be italic on "View Issue Details" and some other pages.

This is caused by using `string_display_line` instead of `string_attribute`

`$g_html_valid_tags_single_line` / `string_display_line`should just be considered for the values of
- Standard "Summary" field
- Custom field values of type String
- ???

Affected fields
- user name, real name, email
- project name
- profile fields
- categories
- version and build fields
- token name
- enum values
- config names and values
- ...

Related 0034463
Follow up to 0034432:0068904