MantisBT: master-2.28 6eecc70a

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master-2.28 2026-05-30 17:52 master-2.28 de2f71fd
Affected Issues  0037200: CVE-2026-52883: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Changeset

Fix broken PHPUnit tests

  • Incorrect assignment of time_tracking duration in mc_issue_update()
  • Adapt IssueUpdateTest::testUpdateWithNewNote()

Adding a TIME_TRACKING note (type 2) with note_attr makes no sense as
the latter is only used for REMINDER notes. TIME_TRACKING requires
a duration, which is set with time_tracking attribute.

Fixes 0037200
mod - api/soap/mc_issue_api.php Diff File
mod - tests/soap/IssueUpdateTest.php Diff File