Changesets: MantisBT
|
master-2.28 b80bd8bd 2026-03-19 14:21 Details Diff |
Ensure csv_escape_string() deals with a string This prevents a PHP warning when using array dereferencing form to get $p_string's first character. When this happened, the strpos() call would return 0, leading to always (and sometimes incorrectly) qualifying the string as risky, resulting in a tab character to be prepended. Note: using a type cast instead of string TypeDef in function signature to avoid regression issues in case some callers pass NULL. Fixes 0036987 |
Affected Issues 0036987 |
|
| mod - core/csv_api.php | Diff File | ||
|
master-2.28 3f952e68 2026-03-16 13:40 Details Diff |
Only authorized users can create global profiles Due to a missing access level check, an authenticated user allowed to create personal profiles (add_profile_threshold) was able to create a global profile despite not having manage_global_profile_threshold privilege. Adding access_ensure_global_level() to prevent auth bypass. Fixes 0036974, GHSA-68w5-w573-q2r8 |
Affected Issues 0036974 |
|
| mod - account_prof_update.php | Diff File | ||
|
master-2.28 fb70536b 2026-03-16 12:27 Details Diff |
Set version to 2.28.2-dev | ||
| mod - api/rest/mantisbt_openapi.yaml | Diff File | ||
| mod - core/constant_inc.php | Diff File | ||
|
master cb1a1811 2026-03-16 08:17 Details Diff |
Merge tag 'release-2.28.1' Manually excluded Version bump (61082fb5bc65fbc35973a4b08d63d7e9db1e3f97). |
||
| mod - api/soap/mc_api.php | Diff File | ||
| mod - core/classes/IssueTagTimelineEvent.class.php | Diff File | ||
| mod - lang/strings_french.txt | Diff File | ||
| mod - tag_delete.php | Diff File | ||
|
master 51b5d884 2026-03-16 08:08 translatewiki.net Details Diff |
Localisation updates from https://translatewiki.net. [skip ci] | ||
| mod - lang/strings_belarusian_tarask.txt | Diff File | ||
|
master-2.28 61082fb5 2026-03-16 08:04 Details Diff |
Bump version to 2.28.1 | ||
| mod - api/rest/mantisbt_openapi.yaml | Diff File | ||
| mod - core/constant_inc.php | Diff File | ||
|
master-2.28 af7ede1f 2026-03-16 07:58 Details Diff |
Merge security fixes for GHSA-fh48-f69w-7vmp https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fh48-f69w-7vmp |
||
| mod - core/classes/IssueTagTimelineEvent.class.php | Diff File | ||
| mod - tag_delete.php | Diff File | ||
|
master-2.28 f32787c1 2026-03-16 07:39 Details Diff |
Escape unknown tag name in Timeline Timeline API retrieves data from the bug_history table. It can happen that the tag name stored there no longer exists (e.g. if it has been renamed or deleted). In this case, tag_get_by_name() returns false (obviously), causing IssueTagTimelineEvent::html() to fall back to displaying the name stored in the Timeline event as-is, but lack of proper escapeing was allowed XSS / HTML injection. Fixes 0036973 |
Affected Issues 0036973 |
|
| mod - core/classes/IssueTagTimelineEvent.class.php | Diff File | ||
|
master-2.28 80990f43 2026-03-15 20:23 Details Diff |
Properly escape tag name prior to display Prevents XSS when displaying the confirmation message prior to deleting a tag. Fixes 0036971 |
Affected Issues 0036971 |
|
| mod - tag_delete.php | Diff File | ||
|
master-2.28 5e6e52d9 2026-03-15 19:25 Details Diff |
translatewiki.net {{GENDER:*}} tag is unsupported Replace by gender-neutral translation. Fixes 0036972 |
Affected Issues 0036972 |
|
| mod - lang/strings_french.txt | Diff File | ||
|
master-2.28 ba5c862f 2026-03-13 11:04 Committer: dregad Details Diff |
Fix unknown category error in MantisGraph A simple check using category_exists() has been added before calling the problematic function. Fixes 0036969, PR https://github.com/mantisbt/mantisbt/pull/2196 |
Affected Issues 0036969 |
|
| mod - plugins/MantisGraph/pages/issues_trend_bycategory_table.php | Diff File | ||
|
master fb0bfcf5 2026-03-13 10:48 Committer: dregad Details Diff |
Restrict DateTimePicker loading to pages using it New DateTimePicker API: datetimepicker_print() and datetimepicker_get_field() functions. Moved and fixed DateTimePicker and MantisGraph code from common.js to datetimepicker-proxy.js and MantisGraph.js. Added some missed <label> tags. Fixes 0036968 Signed-off-by: Damien Regad <dregad@mantisbt.org> Removed introduction of Today button (split to separate commit). |
Affected Issues 0036968 |
|
| mod - bug_actiongroup_page.php | Diff File | ||
| mod - bug_change_status_page.php | Diff File | ||
| mod - bug_report_page.php | Diff File | ||
| mod - bug_update_page.php | Diff File | ||
| add - core/datetimepicker_api.php | Diff File | ||
| mod - core/layout_api.php | Diff File | ||
| mod - js/common.js | Diff File | ||
| add - js/datetimepicker-proxy.js | Diff File | ||
| mod - manage_proj_ver_edit_page.php | Diff File | ||
| mod - plugins/MantisGraph/core/Period.php | Diff File | ||
| mod - plugins/MantisGraph/files/MantisGraph.js | Diff File | ||
| mod - plugins/MantisGraph/pages/issues_trend_page.php | Diff File | ||
| mod - view.php | Diff File | ||
|
master ada95002 2026-03-12 11:32 Committer: dregad Details Diff |
Restrict Dropzone loading to pages using it A new DropzoneAPI (dropzone_api.php) has been added that contains HTML output functions for dropzone elements transferred from the PrintAPI. The old functions have been retained and marked as obsolete. The common code from the pages has been merged and moved to the DropzoneAPI as the dropzone_print() function. The JavaScript code related to Dropzone has been separated into a file called dropzone-proxy.js and slightly unified. Fixes 0036967 Signed-off-by: Damien Regad <dregad@mantisbt.org> Rebased and squashed commits |
Affected Issues 0036967 |
|
| mod - bug_report_page.php | Diff File | ||
| mod - bug_view_inc.php | Diff File | ||
| mod - bugnote_add_inc.php | Diff File | ||
| add - core/dropzone_api.php | Diff File | ||
| mod - core/html_api.php | Diff File | ||
| mod - core/print_api.php | Diff File | ||
| mod - js/common.js | Diff File | ||
| add - js/dropzone-proxy.js | Diff File | ||
|
master 57618e44 2026-03-12 08:08 translatewiki.net Details Diff |
Localisation updates from https://translatewiki.net. [skip ci] | ||
| mod - lang/strings_hebrew.txt | Diff File | ||
| mod - lang/strings_luxembourgish.txt | Diff File | ||
| add - plugins/Gravatar/lang/strings_serbian.txt | Diff File | ||
| mod - plugins/MantisCoreFormatting/lang/strings_hebrew.txt | Diff File | ||
|
master fb201cfc 2026-03-07 13:18 Committer: community Details Diff |
Fix the print_header_redirect() function The function now never returns control. The second parameter of the function `bool $p_die` has been removed because it has lost its practical meaning. Fixes 0036885, PR https://github.com/mantisbt/mantisbt/pull/2186 |
Affected Issues 0036885 |
|
| mod - account_prefs_reset.php | Diff File | ||
| mod - bug_report_page.php | Diff File | ||
| mod - core/access_api.php | Diff File | ||
| mod - core/authentication_api.php | Diff File | ||
| mod - core/print_api.php | Diff File | ||
| mod - login_cookie_test.php | Diff File | ||
| mod - login_page.php | Diff File | ||
| mod - login_password_page.php | Diff File | ||
| mod - login_select_proj_page.php | Diff File | ||
| mod - logout_page.php | Diff File | ||
| mod - manage_user_delete.php | Diff File | ||
| mod - set_project.php | Diff File | ||
| mod - view_all_bug_page.php | Diff File | ||
| mod - wiki.php | Diff File | ||
|
master 7b74303a 2026-03-07 03:21 Committer: community Details Diff |
Support CDN links in require_js(), require_css() jQuery must be the first script in the list. Fixes 0036874, PR https://github.com/mantisbt/mantisbt/pull/2185 |
Affected Issues 0036874 |
|
| mod - core/html_api.php | Diff File | ||
|
master ec3896de 2026-03-06 20:09 Committer: community Details Diff |
Add the ability to reapply CSP headers. (#2178) Fixes 0036864, PR https://github.com/mantisbt/mantisbt/pull/2178 |
Affected Issues 0036864 |
|
| mod - core/http_api.php | Diff File | ||
|
master 71404459 2026-03-06 20:00 Committer: community Details Diff |
Add database caching to more functions This patch dramatically reduces the number of database queries, especially on the first page of the tracker with projects that have custom fields. - Added database cache to bug_get_bugnote_stats_array(), custom_field_cache_array_rows() and filter_db_get_project_current() - Added database negative result cache to category_cache_array_rows() - Fixed database cache in file_bug_attachment_count_cache() - Added cache of all relationships Fixes 0036889, PR https://github.com/mantisbt/mantisbt/pull/2189 Signed-off-by: Damien Regad <dregad@mantisbt.org> |
Affected Issues 0036889 |
|
| mod - core/bug_api.php | Diff File | ||
| mod - core/category_api.php | Diff File | ||
| mod - core/custom_field_api.php | Diff File | ||
| mod - core/file_api.php | Diff File | ||
| mod - core/filter_api.php | Diff File | ||
| mod - core/relationship_api.php | Diff File | ||
|
master b9875b12 2026-03-06 12:44 Details Diff |
GHA: return error code from curl if install fails Until now, a failure to install MantisBT was detected by the CI builds during the subsequent phase "Post-installation steps" as it generally impossible to complete it if the database is not setup correctly. With this change, if the MantisBT installer exits with an HTTP error code (>= 400), curl will fail with an exit code 22. The --fail-with-body option allows displaying the installer's output. That allows GitHub Actions to catch the error when it occurs, during the "Install MantisBT" phase. Fixes 0036916 |
Affected Issues 0036916 |
|
| mod - build/ci_install_mantis.sh | Diff File | ||
|
master 02c69e2a 2026-03-06 12:31 Details Diff |
Fix static analysis warnings | ||
| mod - core.php | Diff File | ||
|
master d52da260 2026-03-06 12:30 Details Diff |
Use constant instead of hardcoded HTTP status code | ||
| mod - core.php | Diff File | ||
| mod - core/constant_inc.php | Diff File | ||
|
master e600f44e 2026-03-06 12:28 Details Diff |
core: new fatal_error() function Ensures consistent behavior when an error occurs during MantisBT core initialization. In addition to displaying an error message, we now also return a proper HTTP 500 error code (or 1 if running from CLI). Fixes 0036915 |
Affected Issues 0036915 |
|
| mod - core.php | Diff File | ||
|
master adcf1369 2026-03-06 11:36 Details Diff |
GHA: disable builds on PHP 7.4 & 8.0 Fixes 0036914 |
Affected Issues 0036914 |
|
| mod - .github/workflows/mantisbt.yml | Diff File | ||
|
master bdb712f0 2026-03-06 11:35 Details Diff |
Update minimum PHP version to 8.1.0 - Constants - Documentation and README.md - Composer: composer.json changes and lock file update only for now, actual updates of dependencies (composer update) to be done later. Fixes 0036914 |
Affected Issues 0036914 |
|
| mod - README.md | Diff File | ||
| mod - composer.json | Diff File | ||
| mod - composer.lock | Diff File | ||
| mod - core/constant_inc.php | Diff File | ||
| mod - docbook/Admin_Guide/en-US/Installation.xml | Diff File | ||
|
master-2.28 b349e5c8 2026-03-06 11:17 Details Diff |
Add type definition to mci_check_login()'s params Enforcing string type for $p_password prevents authentication bypass on MySQL (CVE-2026-30849). Note that null must be accepted as well, because SOAP API consumers are allowed to send an XML payload without a password (e.g. for anonymous login). For consistency, the type definition is also applied to $p_username. Fixes 0036902, GHSA-fh48-f69w-7vmp |
Affected Issues 0036902 |
|
| mod - api/soap/mc_api.php | Diff File | ||
