MantisBT: master aa2742da

Author Committer Branch Timestamp Parent
dhx dhx master 2010-03-04 06:31 master cf99022f
Affected Issues  0011610: Regular expressions to validate custom list field
Changeset

Fix 0011610: Validate all custom field types

MantisBT was only validating certain custom field types. List/checkbox
style field values were not being validated making it possible for
malicious users to bypass the custom field 'possible values' setting and
set custom field values to be whatever they desired.

All custom field types are now validated to ensure that selected values
are within the bounds of the 'possible values' setting of each custom
field.

This patch also fixes the radio custom field type so that it no longer
behaves like a field with multiple possible values. Only one value can
be specified for a radio field, hence there is no need to treat it like
an array within gpc_api.

mod - core/gpc_api.php Diff File
mod - core/custom_field_api.php Diff File
mod - core/cfdefs/cfdef_standard.php Diff File