Source Control Integration

master 7af2f47a 2011-09-05 00:41 dhx Details Diff	Fix 0013141: Incorrect parameters to config_get function Thanks to Todd Whitesel for finding this problem in filter_api.php and to Roland Becker for providing further assistance. I have grepped the source code and reviewed all other calls to config_get to ensure they correctly use parameters. There was one additional bug discovered in bug_report_page.php. Conflicts: bug_report_page.php	Affected Issues 0013141
	mod - bug_report_page.php	Diff File
	mod - core/filter_api.php	Diff File
master-1.2.x 955d1cb5 2011-09-05 00:41 dhx Details Diff	Fix 0013141: Incorrect parameters to config_get function Thanks to Todd Whitesel for finding this problem in filter_api.php and to Roland Becker for providing further assistance. I have grepped the source code and reviewed all other calls to config_get to ensure they correctly use parameters. There was one additional bug discovered in bug_report_page.php.	Affected Issues 0013141
	mod - bug_report_page.php	Diff File
	mod - core/filter_api.php	Diff File
master-1.2.x cb67e6a6 2011-09-05 00:21 dhx Details Diff	Remove use of filter_var(...) for master-1.2.x Robert Munteanu correctly mentioned on the mailing list that the master-1.2.x branch needs to work with PHP 5.1. The filter_var(...) function is not available in PHP <5.2 and therefore we can't use it in the master-1.2.x branch. We can achieve similar results by removing all null characters from the string (\0). This is OK for our use case which is the use of $_SERVER['SCRIPT_NAME'] - a value that is set by the server and cannot be manipulated by remote users (like PHP_SELF).
	mod - config_defaults_inc.php	Diff File
master 674fbf70 2011-09-04 23:21 dregad Details Diff	Initialize table prefix and suffix to short values within install.php for Oracle This allows the installer to automatically setup a config_inc.php file with appropriately short values, avoiding multiple steps and errors during the install process for oci8. Porting to 1.3 - Conflicts: admin/install.php
	mod - admin/install.php	Diff File
master-1.2.x cad51f20 2011-09-04 22:34 rombert Details Diff	Correct access_has_any_project checks in print_column_selection The access_has_any_project method call takes a user, not a project parameter.
	mod - core/columns_api.php	Diff File
master-1.2.x 338208c5 2011-09-03 22:58 rombert Details Diff	Allow more control over the excel api's output The following changes have been made: - allow declaration of Spreadsheet styles to control the appearance of rows and cells - allow setting of attributes on individual cells The actual output of the excel export is unchanged. The API changes are completely backwards compatible. Fixes 0013290: Allow more control over excel export format	Affected Issues 0013290
	mod - core/excel_api.php	Diff File
master 887d9e50 2011-09-03 22:58 rombert Details Diff	Allow more control over the excel api's output The following changes have been made: - allow declaration of Spreadsheet styles to control the appearance of rows and cells - allow setting of attributes on individual cells The actual output of the excel export is unchanged. The API changes are completely backwards compatible. Fixes 0013290: Allow more control over excel export format	Affected Issues 0013290
	mod - core/excel_api.php	Diff File
master 03f1c7b0 2011-09-03 22:17 Paul Richards Details Diff	Using just script_name is OK, but it's feasible that SCRIPT_NAME isn't set - this is more common in (badly configured?) nginx servers
	mod - config_defaults_inc.php	Diff File
master-1.2.x 98833635 2011-09-03 18:40 dhx Details Diff	Bump version to 1.2.8 and update release notes
	mod - core/constant_inc.php	Diff File
	mod - doc/RELEASE	Diff File
master-1.2.x 0a636b37 2011-09-03 16:36 dhx Details Diff	Issue 0013281: Fix Projax XSS issues (unescaped value attributes) Projax sucks. This is why it was replaced with jQuery in the master branch. However master-1.2.x still uses the older Projax code. The Projax library doesn't attempt to escape values before dumping them in HTML output, thus leading to XSS issues. The easiest workaround is to pass in already-escaped values to the Projax functions. This issue was reported by High-Tech Bridge SA Security Research Lab as part of their advisory #HTB23045, available at https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_mantisbt.html	Affected Issues 0013281
	mod - bug_report_page.php	Diff File
	mod - bug_update_advanced_page.php	Diff File
master e2f30f70 2011-09-03 16:21 dhx Details Diff	Remove unreachable code branch in config_defaults_inc.php Commit 57c944856712cf3fdc7855d10db07da93a82e863 introduced an unreachable code branch that has no effect. Removed. The functionality will likely need to be rechecked by Paul/John to see whether we do want to use PHP_SELF.
	mod - config_defaults_inc.php	Diff File
master-1.2.x 965b00a0 2011-09-03 15:34 dhx Details Diff	Revert "Fix 0013282, 0013283: bug_actiongroup_ext_page.php LFI and XSS" This reverts commit a7eacc181185eff1dd7bd8ceaa34a91cf86cc298. Paul fixed this in a better way with commit a908cc61362059025910e2437d55bedc31863139 (to be backported to 1.2.x after this older commit is reverted).	Affected Issues 0013282, 0013283
	mod - bug_actiongroup_ext_page.php	Diff File
	mod - core/bug_group_action_api.php	Diff File
master f3df5f1c 2011-09-02 02:07 dregad Details Diff	Modified generated SQL for triggers in install.php to work with Oracle sqlplus "CREATE OR REPLACE TRIGGER" statements must end with END; / to work for Oracle sqlplus Original patch provided by Carsten Grohmann in issue 0013227 Porting to 1.3 - Conflicts: admin/install.php	Affected Issues 0013227
	mod - admin/install.php	Diff File
master 803446e9 2011-09-02 01:58 dregad Details Diff	Improve Oracle DB connection check in install.php Oracle supports DB bindings in two ways: 1. Use hostname, username/password and database name 2. Use tns name (insert into hostname field) and username/password, database name is still empty Original patch provided by Carsten Grohmann in issue 0013227 Porting to 1.3 - Conflicts: admin/install.php	Affected Issues 0013227
	mod - admin/install.php	Diff File
master-1.2.x a7eacc18 2011-08-31 22:36 dhx Details Diff	Fix 0013282, 0013283: bug_actiongroup_ext_page.php LFI and XSS High-Tech Bridge SA Security Research Lab reported 2 issues with the 'action' parameter to bug_actiongroup_ext_page.php Issue 0013282 XSS issue with require_once() call failures returning an unescaped user-supplied filename. There has been a fair amount of recent public talk about PHP error messages being a source of XSS issues. This is an example. Issue 0012283 Local file inclusion/path traversal vulnerability on web servers that allow translations like: http://example.com/directory/file.htm/../file2.htm ==> http://example.com/directory/file2.htm Vulnerable (default configuration): Apache Not vulnerable (default configuration): nginx This issue has _SEVERE_ consequences for people using web servers which don't check each segment of a path from top to bottom for validity. It shouldn't be possible to include the contents of config_inc.php to retrieve MantisBT database passwords because require_once('config_inc.php') will parse the document as a PHP script (echoing nothing). However it may allow attackers to view private files accessible to the web server user account. It also allows an attacker to guess the file structure of a server (existence of installed software, user accounts, etc). nginx will produce a 404 error when it determines that file.htm is not a directory. This makes too much sense, doesn't it?	Affected Issues 0013282, 0013283
	mod - bug_actiongroup_ext_page.php	Diff File
	mod - core/bug_group_action_api.php	Diff File
master c12a32af 2011-08-31 22:36 dhx Details Diff	Fix 0013282, 0013283: bug_actiongroup_ext_page.php LFI and XSS High-Tech Bridge SA Security Research Lab reported 2 issues with the 'action' parameter to bug_actiongroup_ext_page.php Issue 0013282 XSS issue with require_once() call failures returning an unescaped user-supplied filename. There has been a fair amount of recent public talk about PHP error messages being a source of XSS issues. This is an example. Issue 0012283 Local file inclusion/path traversal vulnerability on web servers that allow translations like: http://example.com/directory/file.htm/../file2.htm ==> http://example.com/directory/file2.htm Vulnerable (default configuration): Apache Not vulnerable (default configuration): nginx This issue has _SEVERE_ consequences for people using web servers which don't check each segment of a path from top to bottom for validity. It shouldn't be possible to include the contents of config_inc.php to retrieve MantisBT database passwords because require_once('config_inc.php') will parse the document as a PHP script (echoing nothing). However it may allow attackers to view private files accessible to the web server user account. It also allows an attacker to guess the file structure of a server (existence of installed software, user accounts, etc). nginx will produce a 404 error when it determines that file.htm is not a directory. This makes too much sense, doesn't it? Conflicts: bug_actiongroup_ext_page.php core/bug_group_action_api.php	Affected Issues 0013282, 0013283
	mod - bug_actiongroup_ext_page.php	Diff File
	mod - core/bug_group_action_api.php	Diff File
master ce56bd57 2011-08-31 02:32 dregad Details Diff	Obsolete $g_show_attachment_indicator option Following discussion with dhx on IRC on 31-Aug-2011, this setting is not necessary. There is no point or advantage in displaying a paperclip bitmap as opposed to the actual number of attachments; furthermore, the option was inconsistently used, in one instance it was actually hiding the attachments column completely Affects issue 0013276 Porting 3323204d0c3e6031b182b7113e7afb99d861588d to master	Affected Issues 0013276
	mod - config_defaults_inc.php	Diff File
	mod - core/columns_api.php	Diff File
	mod - core/helper_api.php	Diff File
	mod - core/obsolete.php	Diff File
master-1.2.x 3323204d 2011-08-31 02:32 dregad Details Diff	Obsolete $g_show_attachment_indicator option Following discussion with dhx on IRC today, this setting is not necessary. There is no point or advantage in displaying a paperclip bitmap as opposed to the actual number of attachments; furthermore, the option was inconsistently used, in one instance it was actually hiding the attachments column completely Affects issue 0013276 Commit also removes trailing whitespace in columns_api.php	Affected Issues 0013276
	mod - config_defaults_inc.php	Diff File
	mod - core/columns_api.php	Diff File
	mod - core/helper_api.php	Diff File
	mod - core/obsolete.php	Diff File
master 791b9365 2011-08-31 02:22 dregad Details Diff	Removed obsolete comment file_can_view_bug_attachments does check for allow_view_own_attachments
	mod - core/columns_api.php	Diff File
master-1.2.x a1b29d21 2011-08-31 02:22 dregad Details Diff	Removed obsolete comment file_can_view_bug_attachments does check for allow_view_own_attachments
	mod - core/columns_api.php	Diff File
master a1433711 2011-08-31 01:54 dregad Details Diff	Update list of standard columns in config_defaults_inc.php The list now matches what is actually available in the manage columns pages Porting ad006ff0bf7ea015920ec6a1a7507062646e2679 to master
	mod - config_defaults_inc.php	Diff File
master-1.2.x ad006ff0 2011-08-31 01:54 dregad Details Diff	Update list of standard columns in config_defaults_inc.php The list now matches what is actually available in the manage columns pages
	mod - config_defaults_inc.php	Diff File
master d5a0ea7b 2011-08-31 01:31 dregad Details Diff	Correct naming of attachments column Commit 97b67e4bbb2f2df5f6fb24eea5b4bb37e1c28acd introduced some changes to the BugData class: the 'attachment' column was renamed to 'attachment_count'. This change was not cascaded everywhere, which resulted in the column not being displayed by default (as the now-invalid column named 'attachment' was automatically removed) This then hid the fact that $g_show_attachment_indicator was actually not working as advertised, i.e. the attachments column is always displayed; when ON the field contains the paperclip bitmap, and when OFF the actual number of attachments for the corresponding issue. Affects issue 0013276 This is porting d86ba7220b1b5f9b6eab2eaef44f1345e6699df0 to master	Affected Issues 0013276
	mod - config_defaults_inc.php	Diff File
	mod - core/filter_api.php	Diff File
	mod - core/helper_api.php	Diff File
	mod - view_filters_page.php	Diff File
master-1.2.x d86ba722 2011-08-31 01:31 dregad Details Diff	Correct naming of attachments column Commit 97b67e4bbb2f2df5f6fb24eea5b4bb37e1c28acd introduced some changes to the BugData class: the 'attachment' column was renamed to 'attachment_count'. This change was not cascaded everywhere, which resulted in the column not being displayed by default (as the now-invalid column named 'attachment' was automatically removed) This then hid the fact that $g_show_attachment_indicator was actually not working as advertised, i.e. the attachments column is always displayed; when ON the field contains the paperclip bitmap, and when OFF the actual number of attachments for the corresponding issue. Affects issue 0013276 This commit also removes some trailing whitespace	Affected Issues 0013276
	mod - config_defaults_inc.php	Diff File
	mod - core/filter_api.php	Diff File
	mod - core/helper_api.php	Diff File
	mod - view_filters_page.php	Diff File
master-2.0.x 9f6de921 2011-08-30 12:57 Paul Richards Details Diff	Project override should only apply if $p_project hasn't been explicity set. For the most part, we use config_get(var) to get information for the current project [or overriden project] If we are explicity passing in a project ID, we should use this ID instead, and not override.
	mod - core/config_api.php	Diff File

Changesets: MantisBT