MantisBT - Issues

0037286: Update Guzzle to 7.14.3

Wed, 15 Jul 2026 08:03:14 -0400

Dependabot PRs
- https://github.com/mantisbt/mantisbt/pull/2237 (7.13.1)
- https://github.com/mantisbt/mantisbt/pull/2240 (7.13.2)
- https://github.com/mantisbt/mantisbt/pull/2244 (7.14.1)
- https://github.com/mantisbt/mantisbt/pull/2245 (7.14.2) - security issue

0035629: New Menu API

Tue, 14 Jul 2026 09:30:36 -0400

I think it is necessary to separate the code that collects links to form the main side menu into a separate API file. Now the `layout_api.php` file is quite large and contains more than 1300 lines. Of these, 250 lines are not used to print the actual layout of the page, but instead form a list of menu items.

Also, a new API is needed for correct generation of the sitemap ( 0035523 ).

0037283: Refactoring upgrade_unattended.php

Mon, 13 Jul 2026 18:50:36 -0400

No changes to the overall processing, just some optimization, improved output log text, code cleanup and PHPDoc changes.

0037288: Upgrade Slim Framework to 3.13.0

Mon, 13 Jul 2026 18:47:43 -0400

Slim released a new [3.13.0 release](https://github.com/slimphp/Slim/releases#release-3.13.0) in April 2026 with PHP 8.1-8.5 support, despite the [earlier statement](https://github.com/slimphp/Slim/pull/3186#issuecomment-1098254226) by the Slim project team that 3.x was end-of-life and would not be updated.

We should upgrade to that and revert the workarounds implemented in 0032866 and 0035284.

0037305: Docbook manual builds: remove legacy MAKE build method

Mon, 13 Jul 2026 18:42:57 -0400

When the script was refactored in 2013 (see #15887), the legacy build method based on MAKE was kept for backwards compatibility, called when the Publican configuration file (*publican.cfg*) is not present.

This part of the script is not functional anymore; even if it were, it would not work anyway since the Makefile calls Publican, which would fail due to the missing config file.

This code path should be removed.

0037304: Build scripts: abort execution when an external command fails

Mon, 13 Jul 2026 18:42:57 -0400

The main build script (buildrelease-repo.py) is relies on helper scripts (buildrelease.py and docbook-manual.py).

If an external command fails within one of these child scripts, the error is shown on screen but the exit code is not captured by the caller, which continues its execution as though everything ran successfully.
```
(...)
Running /Users/dregad/bin/publican clean
/Users/dregad/dev/mantisbt/mantis/docbook/Admin_Guide
ERROR: Command '['/Users/dregad/bin/publican', 'clean']' returned non-zero exit status 1.
Creating release tarballs...
(...)
```

Execution should have stopped after ERROR.

0037306: Build scripts: use subprocess module

Mon, 13 Jul 2026 18:40:32 -0400

The scripts use a variety of methods to run external processes: *os.system*, *os.popen* (deprecated in Python 3.14), *subprocess.call* and *subprocess.check_call*.

We should standardise on using *subprocess.run* (available since Python 3.5) instead.

Also avoid creating a sub shell.

0023689: UI Layout improvement

Mon, 13 Jul 2026 18:34:28 -0400

I like the new layout and general appearance of the new UI, to facilitate the use of the mantis I suggest that the top button bar always be visible at the top of the page as attached image.

Related to 0022253

0031699: Upgrade Slim Framework to 4.x

Mon, 06 Jul 2026 13:08:26 -0400

Slim 3.x has reached end-of-life and is only getting security updates. PHP 8.1 compatibility is limited, and the Slim team have [clearly stated][1] that they will not accept pull request to fix that.

The latest version of Slim (4.11.0 as of this writing) requires PHP 7.4.

[1]: https://github.com/slimphp/Slim/pull/3186#issuecomment-1098254226

0037219: Security: Add allowed_classes => false to unserialize() calls to prevent PHP Object Injection

Mon, 06 Jul 2026 04:14:06 -0400

The following functions call unserialize() without specifying allowed_classes:

- filter_api.php (filter deserialization from session/database)
- email_queue_api.php (email queue deserialization)
- safe_unserialize() helper

This leaves them potentially vulnerable to PHP Object Injection (POI) via gadget
chains using classes already loaded in memory, even when the data source appears
trusted.

Fix: Add ['allowed_classes' => false] as a defence-in-depth hardening measure.
The deserialized data in these locations is always a plain array of scalar values —
no object instantiation is expected — so this change does not affect functionality.

GitHub PR with the fix: https://github.com/mantisbt/mantisbt/pull/2229

0037284: API: target_version missing in issue response

Mon, 06 Jul 2026 02:55:57 -0400

When fetching an Issue over the API using
GET {{url}}/api/rest/issues/:issue_id
the fields "version" and "fixed_in_version" are returned, but not "target_version".

The PATCH endpoint accepts changing "target_version", but doesn't show it in the response.

0037285: Update PHPMailer to 7.1.1

Sat, 04 Jul 2026 18:54:10 -0400

[PHPMailer 7.1.0](https://github.com/PHPMailer/PHPMailer/releases/tag/v7.1.0) is a maintenance and and minor security release. MantisBT is not affected by the
[PHPMailer 7.1.1](https://github.com/PHPMailer/PHPMailer/releases/tag/v7.1.1) is a maintenance release.

PR https://github.com/mantisbt/mantisbt/pull/2238

0011363: Fatal: Call to undefined function ctype_space() in library/rssbuilder/class.RSSBase.inc.php

Sat, 04 Jul 2026 18:43:14 -0400

When I click the rss icon in the head of the page,nothing displayed but this error:
Fatal error: Call to undefined function ctype_space() in /home/vhosts/www.lonmo.com/dev/library/rssbuilder/class.RSSBase.inc.php on line 64

0022118: upgrade_unattended will not complete if install_stored_filter_migrate is a required step

Thu, 02 Jul 2026 18:23:23 -0400

stored_filter_migrate is a required step for upgrading to db version 195. However, it eventually calls auth_get_current_user_id() which can't find the current user an so calls access_denied() which calls exit stopping the filter conversion on the first filter.

0021678: After upgrade 1.2.19 -> 1.3.1 database structure still out of date.

Thu, 02 Jul 2026 18:10:43 -0400

After upgrading I still message in login screen.

Warning: The database structure may be out of date. Please upgrade here before logging in.

How can IO verify that the database upgrade is succesfull?

In notice that the record database_version is not being updated in table mantis_config_table ( still shown 194 in stead of 209 ).
Due to the fact that it is trying an INSERT ( with unique key ) in stead of UPDATE.

0037144: Optional plugin dependencies are not displayed

Wed, 01 Jul 2026 18:51:14 -0400

The `manage_plugin_page.php` page does not display information about optional plugin dependencies.
Having complete information about plugins would be useful for administrators, particularly when a new dependency appears in an updated version of a plugin.

0019370: Retire 'user_print_pref' table and related code

Tue, 30 Jun 2026 18:11:54 -0400

Seems like a table that was used to select columns to show in print page. We now have a different model for customizing columns across all features.

0037227: Remove code specific to PHP safe_mode

Tue, 30 Jun 2026 17:56:55 -0400

Safe mode has been removed from PHP in 5.4.
We require PHP 5.5 since 2.7.0 (0023378).

Identified occurrences:
- check in install.php
- 3 calls to set_time_limit() with `@` operator (see 0004555, 0008830)
- helper_begin_long_process()
- admin/upgrade_unattended.php

0037264: resumo est

Thu, 25 Jun 2026 10:12:00 -0400

teste

0037263: Testing Tiket

Mon, 22 Jun 2026 04:29:14 -0400

Testing Tiket

0020431: Use utf8mb4 charset for new MySQL installations

Mon, 15 Jun 2026 17:39:13 -0400

We currently create the database with 'utf8' charset and 'general_ci' collation.

In MySQL, utf8 charset uses up to 3 bytes, which means some characters can't be stored properly. Since MySQL 5.5.3 the 'utf8mb4' charset is available, and does not have this limitation.

We should use utf8mb4 for new installation.

In addition, we default to 'general' collation which sometimes yield incorrect sort order for special (multibyte) characters. See MySQL documentation [1] for examples and more explanation.

[1] http://dev.mysql.com/doc/refman/5.7/en/charset-unicode-sets.html

0037252: Erro ao cadastrar funcionario

Thu, 11 Jun 2026 19:07:00 -0400

FGFgfgfgfgf

0037133: The buttons on the “Access Denied” widget may contain incorrect links

Wed, 03 Jun 2026 11:19:38 -0400

For example, the “/admin/login_page.php?return=admin%2Findex.php” is converted to “admin/login_page.php?return=admin%2Findex.php” for "Login" button.

0037221: Login button not working on mobile Page crashes on submit User cannot reset password

Mon, 01 Jun 2026 08:04:02 -0400

0037182: A way to see all users without any activity

Mon, 01 Jun 2026 05:07:28 -0400

Hi,

On the Users page (https://bugs.xdebug.org/manage_user_page.php), it is possible to see all users that never logged in (Unused), or are New. I would like there to be a additional tab for users that never had any activity (no bugs, notes, attachments, or monitored issues).

I have created a patch for that, which I have attached. It's my first one, so please be kind. I also don't know if I missed any other possible activities, but these can be easily added.

If this seems suitable, I can also provide some translations.

cheers,
Derick