Changesets: MantisBT

master-2.27 a90611fb

2025-11-01 07:12

dregad


Details Diff
Bump version to 2.27.2
mod - core/constant_inc.php Diff File

master-2.27 ed56f8be

2025-11-01 07:09

dregad


Details Diff
Update Credits
mod - doc/CREDITS Diff File

master-2.27 e9119c68

2025-10-31 03:56

dregad


Details Diff
Restrict size of textarea fields

A lack of server-side validation for note length in MantisBT allows
attackers to permanently corrupt issue activity logs by submitting
extremely long notes. Once such a note is added:

- The entire activity stream becomes unviewable (UI fails to render).
- New notes cannot be displayed, effectively breaking all future
collaboration on the issue.

Fixes 0035893, CVE-2025-46556, GHSA-r3jf-hm7q-qfw5
Affected Issues
0035893
mod - account_prof_edit_page.php Diff File
mod - account_prof_menu_page.php Diff File
mod - admin/check/check_customfields_inc.php Diff File
mod - admin/check/index.php Diff File
mod - bug_actiongroup_add_note_inc.php Diff File
mod - bug_actiongroup_page.php Diff File
mod - bug_change_status_page.php Diff File
mod - bug_reminder_page.php Diff File
mod - bug_report_page.php Diff File
mod - bug_update_page.php Diff File
mod - bugnote_add_inc.php Diff File
mod - bugnote_edit_page.php Diff File
mod - bugnote_update.php Diff File
mod - config_defaults_inc.php Diff File
mod - core/bug_api.php Diff File
mod - core/bugnote_api.php Diff File
mod - core/cfdefs/cfdef_standard.php Diff File
mod - core/commands/IssueAddCommand.php Diff File
mod - core/constant_inc.php Diff File
mod - core/custom_field_api.php Diff File
mod - core/helper_api.php Diff File
mod - core/profile_api.php Diff File
mod - docbook/Admin_Guide/en-US/config/html.xml Diff File
mod - lang/strings_english.txt Diff File
mod - manage_custom_field_edit_page.php Diff File
mod - tests/rest/RestBase.php Diff File
add - tests/rest/RestIssueNotesTest.php Diff File
mod - tests/rest/RestIssueTest.php Diff File
mod - tests/soap/IssueAddTest.php Diff File
mod - tests/soap/IssueNoteTest.php Diff File
mod - tests/soap/SoapBase.php Diff File

master e18293ea

2025-10-30 08:14

translatewiki.net


Details Diff
Localisation updates from https://translatewiki.net. [skip ci]
mod - lang/strings_norwegian_bokmal.txt Diff File

master-2.27 2a0821df

2025-10-29 14:07

dregad


Details Diff
Also check Textarea CF's Default Value length
mod - admin/check/check_customfields_inc.php Diff File
mod - admin/check/index.php Diff File

master-2.27 c048bf83

2025-10-29 13:22

dregad


Details Diff
Add Maximum PHP version check

Merge PR https://github.com/mantisbt/mantisbt/pull/2157
mod - .github/workflows/mantisbt.yml Diff File
mod - admin/check/check_php_inc.php Diff File
mod - core.php Diff File
mod - core/constant_inc.php Diff File

master 154f796e

2025-10-29 13:18

dregad


Details Diff
GHA: Fix invalid syntax

Forgot to remove the `include:`...
mod - .github/workflows/mantisbt.yml Diff File

master aa4aefc7

2025-10-29 13:13

dregad


Details Diff
GHA: PHP 8.4 builds no longer experimental
mod - .github/workflows/mantisbt.yml Diff File

master-2.27 97dacffa

2025-10-29 13:07

dregad


Details Diff
GHA: remove PHP 8.4 builds for master-2.27 branch

We know these are failing and since the Issues will not be fixed in 2.27
it makes no sense to run the jobs.
mod - .github/workflows/mantisbt.yml Diff File

master-2.27 6186d932

2025-10-27 20:47

dregad


Details Diff
Remove debugging code
mod - admin/check/check_customfields_inc.php Diff File

master-2.27 491c84c2

2025-10-27 20:42

dregad


Details Diff
Use config_get_global()
mod - admin/check/check_customfields_inc.php Diff File

master 8913f8d6

2025-10-27 08:15

translatewiki.net


Details Diff
Localisation updates from https://translatewiki.net. [skip ci]
mod - lang/strings_luxembourgish.txt Diff File
mod - lang/strings_russian.txt Diff File
mod - lang/strings_turkish.txt Diff File

master-2.27 a91753e8

2025-10-26 20:02

dregad


Details Diff
Add MantisBT version to error message

Issue 0036540
Affected Issues
0036540
mod - core.php Diff File

master-2.27 5f76868b

2025-10-26 19:43

dregad


Details Diff
Add missing project_id param in report URL

Fixes 0036540
Affected Issues
0036540
mod - admin/check/check_php_inc.php Diff File

master-2.27 21e9fbed

2025-10-26 14:21

dregad


Details Diff
Verify new email after email change

Fixes 0036005, CVE-2025-55155, GHSA-q747-c74m-69pr
Affected Issues
0036005
mod - account_page.php Diff File
mod - account_update.php Diff File
mod - api/soap/mc_account_api.php Diff File
mod - core/commands/UserUpdateCommand.php Diff File
mod - core/constant_inc.php Diff File
mod - core/email_api.php Diff File
mod - core/print_api.php Diff File
mod - core/string_api.php Diff File
mod - core/tokens_api.php Diff File
mod - core/user_api.php Diff File
mod - lang/strings_english.txt Diff File
mod - lost_pwd.php Diff File
mod - manage_user_edit_page.php Diff File
mod - manage_user_page.php Diff File
mod - verify.php Diff File
add - verify_email.php Diff File

master-2.27 38d698f7

2025-10-26 14:10

dregad


Details Diff
Do not append newline to bugnote text

This appears to be a remnant of when a the edit date was appended to the
end of the bugnote's text. The code adding the newline separators was
not removed when this was changed in issue 0004383.

Fixes 0036542
Affected Issues
0004383, 0036542
mod - bugnote_update.php Diff File

master-2.27 6c7fb31e

2025-10-26 12:49

dregad


Details Diff
Fix typo in variable name
mod - core/bugnote_api.php Diff File

master-2.27 5b5a31ec

2025-10-26 12:22

dregad


Details Diff
Align PHP_MIN_VERSION check

For consistency, use same logic and error message formatting.
mod - core.php Diff File

master-2.27 1401d2dc

2025-10-26 12:17

dregad


Details Diff
Differentiate "max" and "max supported" PHP versions

Introduce a new PHP_SUPPORTED_VERSION constant and add a comment block
to explain usage of the 3 PHP-version-related constants.

Enforce PHP_MAX_VERSION in core.php, like we do for PHP_MIN_VERSION.

Adapt the Admin Check to use PHP_SUPPORTED_VERSION; check is downgraded
to warning since the hard fail is already taken care of.

PHP_SUPPORTED_VERSION should be defined with 2 numbers (X.Y) to cover
all versions including pre-releases.

Fixes 0036540
Affected Issues
0036540
mod - admin/check/check_php_inc.php Diff File
mod - core.php Diff File
mod - core/constant_inc.php Diff File

master-2.27 4bd78321

2025-10-26 06:59

dregad


Details Diff
Set PHP_MAX_VERSION to 8.4.0

Fixes 0036540
Affected Issues
0036540
mod - core/constant_inc.php Diff File

master-2.27 a3226bfb

2025-10-26 06:58

dregad


Details Diff
Add Admin check for max PHP version

Fixes 0036540
Affected Issues
0036540
mod - admin/check/check_php_inc.php Diff File

master-2.27 01c12d31

2025-10-25 19:18

dregad


Details Diff
Use gpc_get_int() to retrieve user id
mod - verify.php Diff File
mod - verify_email.php Diff File

master-2.27 b13e3fc3

2025-10-25 18:56

dregad


Details Diff
Add check for Textarea CF max length
mod - admin/check/check_customfields_inc.php Diff File

master-2.27 321edde1

2025-10-25 12:22

dregad


Details Diff
Refactor custom field admin checks

To avoid code duplication and simplify introduction of future new checks
define an abstract class that can be extended to implement specific
checks, and a controller class that will loop over the registered Custom
Field definitions.

Fixes 0036535
Affected Issues
0036535
mod - admin/check/check_customfields_inc.php Diff File

master ac503005

2025-10-24 19:25

dregad


Details Diff
Use ADOdb dev-hotfix/5.22 branch

Temporary change until 5.22.11 has been released, so we get the patch
for https://github.com/ADOdb/ADOdb/issues/1143.

Issue 0036618
Affected Issues
0036618
mod - composer.json Diff File
mod - composer.lock Diff File
 First  Prev  1 2 3 ... 25 26 27 28 29 30 31 ... 80 ... 160 ... 240 ... 320 ... 400 ... 480 ... 560 ... 640 ... 720 ... 762 763 764  Next  Last