Changesets: MantisBT
|
next 7339a7ed 2011-09-09 19:24 Details Diff |
Implement SessionHandlerInvalid exception | ||
| add - application/MantisBT/Exception/Session/SessionHandlerInvalid.php | Diff File | ||
| mod - application/core/session_api.php | Diff File | ||
|
next 7c5a3b4b 2011-09-09 19:22 Details Diff |
Implement SessionVariableNotFound exception | ||
| add - application/MantisBT/Exception/Session/SessionVariableNotFound.php | Diff File | ||
| mod - application/core/session_api.php | Diff File | ||
|
next b2b06bf7 2011-09-09 19:22 Details Diff |
Implement SessionVariableNotFound exception | ||
| add - application/MantisBT/Exception/Session/SessionVariableNotFound.php | Diff File | ||
| mod - application/core/session_api.php | Diff File | ||
|
next eb3507d2 2011-09-09 19:22 Details Diff |
Implement SessionVariableNotFound exception | ||
| add - application/MantisBT/Exception/Session/SessionVariableNotFound.php | Diff File | ||
| mod - application/core/session_api.php | Diff File | ||
|
next 00efe7bd 2011-09-09 19:13 Details Diff |
Implement TagNameInvalid exception | ||
| add - application/MantisBT/Exception/Tag/TagNameInvalid.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next 3d068dd7 2011-09-09 19:13 Details Diff |
Implement TagNameInvalid exception | ||
| add - application/MantisBT/Exception/Tag/TagNameInvalid.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next 57784e27 2011-09-09 19:13 Details Diff |
Implement TagNameInvalid exception | ||
| add - application/MantisBT/Exception/Tag/TagNameInvalid.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next 5ce97b56 2011-09-09 19:07 Details Diff |
Implement TagNameNotUnique exception | ||
| add - application/MantisBT/Exception/Tag/TagNameNotUnique.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next 83445343 2011-09-09 19:07 Details Diff |
Implement TagNameNotUnique exception | ||
| add - application/MantisBT/Exception/Tag/TagNameNotUnique.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next d9df1b5e 2011-09-09 19:07 Details Diff |
Implement TagNameNotUnique exception | ||
| add - application/MantisBT/Exception/Tag/TagNameNotUnique.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next be09b397 2011-09-09 18:58 Details Diff |
Implement TagNotFound exception | ||
| add - application/MantisBT/Exception/Tag/TagNotFound.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next 4869aeea 2011-09-09 18:58 Details Diff |
Implement TagNotFound exception | ||
| add - application/MantisBT/Exception/Tag/TagNotFound.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
next 4869ed67 2011-09-09 18:58 Details Diff |
Implement TagNotFound exception | ||
| add - application/MantisBT/Exception/Tag/TagNotFound.php | Diff File | ||
| mod - application/core/tag_api.php | Diff File | ||
|
master-1.2.x efb8b6b8 2011-09-09 10:25 Details Diff |
Support for multi-dimentional arrays in admin_config_set.php This commit adds support for multi-dimentional arrays, as well as correct handling of commas and '=>' within strings. This is based on work by jspezeski; the original code was modified to align with MantisBT coding guidelines, simplification of the recursive function and fixing a couple of errors in regex. Fixes 0013298 |
Affected Issues 0013298 |
|
| mod - adm_config_set.php | Diff File | ||
|
master 8b98640d 2011-09-09 10:25 Details Diff |
Support for multi-dimentional arrays in admin_config_set.php This commit adds support for multi-dimentional arrays, as well as correct handling of commas and '=>' within strings. This is based on work by jspezeski; the original code was modified to align with MantisBT coding guidelines, simplification of the recursive function and fixing a couple of errors in regex. Fixes 0013298 |
Affected Issues 0013298 |
|
| mod - adm_config_set.php | Diff File | ||
|
master-2.0.x 8c25d5f9 2011-09-09 09:52 Paul Richards Details Diff |
Fix typo in ldap documentation | ||
| mod - config_defaults_inc.php | Diff File | ||
|
master-2.0.x d39e5df7 2011-09-09 09:32 Paul Richards Details Diff |
Tidy up utility api | ||
| mod - core/utility_api.php | Diff File | ||
| mod - signup.php | Diff File | ||
| mod - signup_page.php | Diff File | ||
|
master-1.2.x 5835572f 2011-09-08 20:17 Details Diff |
Fix 0013280: Incorrect queries logged when sorting by custom field having accented chars The offsets returned by preg_match are byte-based, which causes issues with UTF-8 characters as the subsequent calls to utf8_substr operate on the wrong part of the string; this results in logging of invalid SQL queries when $g_show_queries_list = ON. This commit fixes the problem by realigning the offsets prior to performing the query parameter substitution. It also simplifies the code by removing parenthesis in the regexp pattern, which is not necessary since we are only matching a single element, this way there is no need to deal with a multi-dimentional array. |
Affected Issues 0013280 |
|
| mod - core/database_api.php | Diff File | ||
|
master 36a34464 2011-09-08 20:17 Details Diff |
Fix 0013280: Incorrect queries logged when sorting by custom field having accented chars The offsets returned by preg_match are byte-based, which causes issues with UTF-8 characters as the subsequent calls to utf8_substr operate on the wrong part of the string; this results in logging of invalid SQL queries when $g_show_queries_list = ON. This commit fixes the problem by realigning the offsets prior to performing the query parameter substitution. It also simplifies the code by removing parenthesis in the regexp pattern, which is not necessary since we are only matching a single element, this way there is no need to deal with a multi-dimentional array. |
Affected Issues 0013280 |
|
| mod - core/database_api.php | Diff File | ||
|
master-2.0.x 53f81844 2011-09-05 09:06 Paul Richards Details Diff |
Remove unreachable code [spotted by dhx] | ||
| mod - config_defaults_inc.php | Diff File | ||
|
master-1.2.x e679a1c0 2011-09-05 02:36 Details Diff |
Fix 0013191: Prevent further XSS issues relating to PHP_SELF Silvia Alvarez (Debian package manager for MantisBT) has performed additional testing of patch d00745f5e267eba4ca34286d125de685bc3a8034 and discovered that the XSS problems surrounding the use of $_SERVER['PHP_SELF'] have not been fully fixed. The form_action_self() function also used $_SERVER['PHP_SELF'] (retrieving the basename() component of the file name). Callees of this function did not escape this file name prior to printing it in the 'action' attribute of <form> elements. This patch swaps out PHP_SELF for SCRIPT_NAME (much safer as end users have no control over the value) and also applies escaping to the 'action' attribute of relevant <form> elements. Refer to Debian bug report #640297 [1] and dicussion on the mantisbt-dev mailing list for further details. Thank you Sils for the detailed analysis of the problem, detailed report, proposed solutions and extensive testing of patches for the latest round of vulnerabilities discovered. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 |
Affected Issues 0013191 |
|
| mod - billing_inc.php | Diff File | ||
| mod - bugnote_stats_inc.php | Diff File | ||
| mod - core/authentication_api.php | Diff File | ||
| mod - core/form_api.php | Diff File | ||
| mod - core/helper_api.php | Diff File | ||
| mod - manage_config_email_page.php | Diff File | ||
| mod - manage_config_work_threshold_page.php | Diff File | ||
| mod - manage_config_workflow_page.php | Diff File | ||
|
master 94e68102 2011-09-05 01:34 Details Diff |
Fix 0012361: Private bug visibility leak in my_view/view_all_bug_page In the My View / View Issues screens, private bugs in public projects (and probably private projects too) appear to ignore the private_bug_threshold value of their project unless you select it. When some projects have tighter security on viewing private bugs than others, this creates a situation where a user who should not be able to see a bug can still discover its existence in My View and View Issues. Viewing it fails with 'access denied', but if the summary had confidential information in it then the security leak has already happened. I don't consider giving All Projects the tighter security to be a usable workaround, because then you can't find bugs in the projects that use normal security for private bugs, until you select one of them, but then you can only see the subproject hierarchy you just went into. Steps to reproduce: ------ On a fresh 1.2.2 install try this: Create a public project. In the project, edit thresholds so that you need manager to view private bugs. Submit a private bug to that project. Login as a different user with global access of developer. View All Projects. You can see the bug in MyView / ViewIssues but then when you click on it you get an Access Denied screen. If you select the bug's project, then it correctly disappears. ------ Signed-off-by: David Hicks <d@hx.id.au> |
Affected Issues 0012361 |
|
| mod - core/filter_api.php | Diff File | ||
|
master-1.2.x cb74408f 2011-09-05 01:34 Details Diff |
Fix 0012361: Private bug visibility leak in my_view/view_all_bug_page In the My View / View Issues screens, private bugs in public projects (and probably private projects too) appear to ignore the private_bug_threshold value of their project unless you select it. When some projects have tighter security on viewing private bugs than others, this creates a situation where a user who should not be able to see a bug can still discover its existence in My View and View Issues. Viewing it fails with 'access denied', but if the summary had confidential information in it then the security leak has already happened. I don't consider giving All Projects the tighter security to be a usable workaround, because then you can't find bugs in the projects that use normal security for private bugs, until you select one of them, but then you can only see the subproject hierarchy you just went into. Steps to reproduce: ------ On a fresh 1.2.2 install try this: Create a public project. In the project, edit thresholds so that you need manager to view private bugs. Submit a private bug to that project. Login as a different user with global access of developer. View All Projects. You can see the bug in MyView / ViewIssues but then when you click on it you get an Access Denied screen. If you select the bug's project, then it correctly disappears. ------ Signed-off-by: David Hicks <d@hx.id.au> |
Affected Issues 0012361 |
|
| mod - core/filter_api.php | Diff File | ||
|
master-2.0.x 495303bb 2011-09-05 01:34 Todd Whitesel Committer: Paul Richards Details Diff |
Fix 0012361: Private bug visibility leak in my_view/view_all_bug_page In the My View / View Issues screens, private bugs in public projects (and probably private projects too) appear to ignore the private_bug_threshold value of their project unless you select it. When some projects have tighter security on viewing private bugs than others, this creates a situation where a user who should not be able to see a bug can still discover its existence in My View and View Issues. Viewing it fails with 'access denied', but if the summary had confidential information in it then the security leak has already happened. I don't consider giving All Projects the tighter security to be a usable workaround, because then you can't find bugs in the projects that use normal security for private bugs, until you select one of them, but then you can only see the subproject hierarchy you just went into. Steps to reproduce: ------ On a fresh 1.2.2 install try this: Create a public project. In the project, edit thresholds so that you need manager to view private bugs. Submit a private bug to that project. Login as a different user with global access of developer. View All Projects. You can see the bug in MyView / ViewIssues but then when you click on it you get an Access Denied screen. If you select the bug's project, then it correctly disappears. ------ Signed-off-by: David Hicks <d@hx.id.au> |
||
| mod - core/filter_api.php | Diff File | ||
|
master b08e9c16 2011-09-05 01:15 Details Diff |
Fix 0013140: Incorrect permissions check during bug reporting and cloning Todd Whitesel reported an issue with incorrect permissions checks being performed when cloning issues. The steps to reproduce this bug were provided by Todd: ------ Fresh 1.2.5 install. Create two users, a Developer and an Updater. Create a private project. (Actually create a couple more projects so you can see the project selector.) Add both users to the private project AS MANAGERS. Login as Developer, select the private project, and create an issue. Login as Updater, select All Projects, and attempt to clone that issue. It fails with ACCESS DENIED error #13. Also note that your access level was Manager while editing the cloned issue, but in the error screen your access level is back to your global access of Updater. As Updater, Select the private project, create an issue. Then select All Projects, and attempt to clone that issue. It succeeds, apparently because you are cloning your own issue. Create a public project and attach the private project as a subproject of it. Retry the above cloning tests with the public parent project instead of All Projects -- the results are the same whether you select All Projects or the parent project. ------ The problem was that the current project (from the project selector dropdown) was used as the basis for config_get calls, thus leading to incorrect permissions and settings being used within bug_report.php. We need to instead switch (temporarily) the current project to either the master issue (when cloning) or the specified project_id (when creating a new issue via bug_report_page.php). Thanks again to Todd for the discovery and debugging of this problem, the detailed bug report and initial patch (that has been extended to resolve the second project_id issue from bug_report_page.php). Conflicts: bug_report.php |
Affected Issues 0013140 |
|
| mod - bug_report.php | Diff File | ||
