Changesets: MantisBT
|
master-1.2.x 58969dfb 2010-09-22 05:14 Details Diff |
Fix 0009663: Changelog underlines incorrect lengths The text underlines on the changelog page are displayed with an incorrect length when the version name contains characters that are encodable via htmlspecialchars(). We need to use the length of the raw string instead of the length of the encoded string. |
Affected Issues 0009663 |
|
| mod - changelog_page.php | Diff File | ||
|
master bc9b2dea 2010-09-21 21:06 Committer: dhx Details Diff |
Fix 0012373: log_event doesn't log simple strings $s_msg doesn't get a value if $p_msg is an array. When $s_msg is used later on in the function it will be undefined, throwing an error. This is solved by giving $s_msg a value when $p_msg is an array. Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012373 |
|
| mod - core/logging_api.php | Diff File | ||
|
master 89c9f85a 2010-09-21 17:58 Details Diff |
Following XSS changes, don't double encode |
Affected Issues 0003767 |
|
| mod - core/custom_field_api.php | Diff File | ||
|
master-1.2.x 76c9a79e 2010-09-21 17:58 Committer: dhx Details Diff |
Following XSS changes, don't double encode |
Affected Issues 0003767 |
|
| mod - core/custom_field_api.php | Diff File | ||
|
master a4349842 2010-09-21 15:19 Committer: dhx Details Diff |
Fix 0012383: Use of invalid color "brown" in CSS Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012383 |
|
| mod - css/default.css | Diff File | ||
|
master-1.2.x d65402a4 2010-09-21 15:19 Committer: dhx Details Diff |
Fix 0012383: Use of invalid color "brown" in CSS Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012383 |
|
| mod - css/default.css | Diff File | ||
|
master-1.1.x 3bc117fc 2010-09-18 19:29 Details Diff |
Fix 0012371: XSS in print_all_bug_page_word.php project/category names Backport of commit bfc9e9 for bug 12238 |
Affected Issues 0012371 |
|
| mod - print_all_bug_page_word.php | Diff File | ||
|
master-1.1.x 51ee3d3f 2010-09-18 19:13 Details Diff |
Fix 0012370: Multiple XSS issues with custom field enumeration values Backport of commit 7ab71d01 fixing bug 12232 |
Affected Issues 0012370 |
|
| mod - core/custom_field_api.php | Diff File | ||
|
master-1.1.x 8f1ebac6 2010-09-18 17:29 Details Diff |
Fix 0012369: XSS vulnerability when deleting maliciously named categories Backport of commit 083c34f06ca927b16e781bae3ae324f450c35ea4 |
Affected Issues 0012369 |
|
| mod - manage_proj_cat_delete.php | Diff File | ||
|
master 544e76d9 2010-09-18 01:32 Committer: dhx Details Diff |
Fix 0011299: Custom menu links should be sanitised before output If an administrator defines custom menu links (consisting of a caption and URL) then these values should be escaped of special HTML characters before being printed into the menu. This XSS issue is of no security concern as it requires administrator access and manual modifications to the configuration file. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0011299 |
|
| mod - core/html_api.php | Diff File | ||
|
master-1.2.x d37df257 2010-09-18 01:32 Committer: dhx Details Diff |
Fix 0011299: Custom menu links should be sanitised before output If an administrator defines custom menu links (consisting of a caption and URL) then these values should be escaped of special HTML characters before being printed into the menu. This XSS issue is of no security concern as it requires administrator access and manual modifications to the configuration file. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0011299 |
|
| mod - core/html_api.php | Diff File | ||
|
master 01d2ffad 2010-09-18 01:19 Details Diff |
Issue 0012368: Remove input side XSS validation of user real names XSS issues should be handled on the output side of MantisBT rather than on the input side. The user real name field was being validated on the input side which is poor design due to the many number of ways in which a user real name could change (SOAP API, XML import, web interface, external scripts, plugins, etc). Furthermore different output interfaces (XML, CSS, XHTML, etc) require different sanitisation and escaping methods. Thus we should remove the input side XSS validation of the user real name field so that we allow ANY characters to be used in this field (except 0x00 of course). Our existing output layers already handle XSS sanitisation of variables such as the real name field. |
Affected Issues 0012368 |
|
| mod - manage_user_create.php | Diff File | ||
| mod - manage_user_update.php | Diff File | ||
| mod - core/user_api.php | Diff File | ||
| mod - core/custom_field_api.php | Diff File | ||
| mod - account_update.php | Diff File | ||
| mod - core/string_api.php | Diff File | ||
|
master c4d7ca49 2010-09-18 00:24 Committer: dhx Details Diff |
Fix 0012286: Sub projects not included in advanced filter ALL PROJECTS When advanced filter "Project" is set to "All Projects" sub projects are excluded from the results returned by the filter. These sub projects should be included. Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012286 |
|
| mod - core/filter_api.php | Diff File | ||
|
master-1.2.x d1a79720 2010-09-18 00:24 Committer: dhx Details Diff |
Fix 0012286: Sub projects not included in advanced filter ALL PROJECTS When advanced filter "Project" is set to "All Projects" sub projects are excluded from the results returned by the filter. These sub projects should be included. Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012286 |
|
| mod - core/filter_api.php | Diff File | ||
|
master e9599997 2010-09-18 00:10 Details Diff |
Fix 0007328: ini_get_number uses wrong postfix multipliers The ini_get_number function currently uses the wrong postfix multipliers when determining the integer value of configuration options from php.ini. The PHP manual clearly states that k = kibibyte instead of k = kilobyte as per http://www.php.net/manual/en/faq.using.php#faq.using.shorthandbytes Thus we need to change the postfix multipliers to reflect what the PHP manual defines for php.ini. Thanks to Morgan Parry for providing a patch to this issue just over 4 years ago. And thanks to Roland Becker for bumping up old issues like this one that have been forgotten in the past. |
Affected Issues 0007328 |
|
| mod - core/utility_api.php | Diff File | ||
|
master-1.2.x 3536e18a 2010-09-18 00:10 Details Diff |
Fix 0007328: ini_get_number uses wrong postfix multipliers The ini_get_number function currently uses the wrong postfix multipliers when determining the integer value of configuration options from php.ini. The PHP manual clearly states that k = kibibyte instead of k = kilobyte as per http://www.php.net/manual/en/faq.using.php#faq.using.shorthandbytes Thus we need to change the postfix multipliers to reflect what the PHP manual defines for php.ini. Thanks to Morgan Parry for providing a patch to this issue just over 4 years ago. And thanks to Roland Becker for bumping up old issues like this one that have been forgotten in the past. |
Affected Issues 0007328 |
|
| mod - core/utility_api.php | Diff File | ||
|
master 3bb92717 2010-09-17 23:35 Details Diff |
Fix 0010995: Unable to read or find fonts when using JpGraph The logic inside the graph_get_font() function of MantisGraph/core/graph_api.php was completely broken when using JpGraph. Thanks to Kirill Krasnov for the initial patch. |
Affected Issues 0010995 |
|
| mod - plugins/MantisGraph/core/graph_api.php | Diff File | ||
|
master-1.2.x ed4de9ae 2010-09-17 23:35 Details Diff |
Fix 0010995: Unable to read or find fonts when using JpGraph The logic inside the graph_get_font() function of MantisGraph/core/graph_api.php was completely broken when using JpGraph. Thanks to Kirill Krasnov for the initial patch. |
Affected Issues 0010995 |
|
| mod - plugins/MantisGraph/core/graph_api.php | Diff File | ||
|
master db2b0070 2010-09-17 22:43 Details Diff |
Fix 0012363: Billing report end date not included in range The end date of a billing report page is not included in the range of issues parsed by the report. This is due to a bug inside bugnote_stats_get_project_array(..) of bugnote_api.php that misinterprets the PHP documentation of how the strtotime() function operates. |
Affected Issues 0012363 |
|
| mod - core/bugnote_api.php | Diff File | ||
|
master-1.2.x aa9540d2 2010-09-17 22:43 Details Diff |
Fix 0012363: Billing report end date not included in range The end date of a billing report page is not included in the range of issues parsed by the report. This is due to a bug inside bugnote_stats_get_project_array(..) of bugnote_api.php that misinterprets the PHP documentation of how the strtotime() function operates. |
Affected Issues 0012363 |
|
| mod - core/bugnote_api.php | Diff File | ||
|
master-1.2.x 972978d8 2010-09-17 22:28 Committer: dhx Details Diff |
Fix 0012354: Fix validation error with HTML script element type attribute Inside html_api, html_head_javascript(..) we set the type of a HTML script element to "javascript" which is incorrect. It should be "text/javascript" instead. Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012354 |
|
| mod - core/html_api.php | Diff File | ||
|
master-1.2.x ea7af5eb 2010-09-17 21:24 Committer: dhx Details Diff |
Fix 0012246: Incorrect call to bug_update in ImportXml The XmlImportExport plugin (specifically ImportXml) makes an incorrect call to the now non-existant bug_update(..) function. This should be replaced with a call to the update() function on the BugData class. Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0011563 |
|
| mod - plugins/XmlImportExport/ImportXml.php | Diff File | ||
|
master 8ce72fe1 2010-09-17 21:12 Details Diff |
Fix 0012362: Redirect users to tag management page after deleting a tag Users who have permission to delete tags also have access to the tag management page. Therefore it makes more sense to redirect users to the tag management page than their default MantisBT start page upon deletion of a tag. |
Affected Issues 0012362 |
|
| mod - tag_delete.php | Diff File | ||
|
master-1.2.x e5ba672d 2010-09-17 21:12 Details Diff |
Fix 0012362: Redirect users to tag management page after deleting a tag Users who have permission to delete tags also have access to the tag management page. Therefore it makes more sense to redirect users to the tag management page than their default MantisBT start page upon deletion of a tag. |
Affected Issues 0012362 |
|
| mod - tag_delete.php | Diff File | ||
|
master d8a4c2ff 2010-09-17 20:50 Committer: dhx Details Diff |
Fix 0012366: file_api uses old style calls to db_get_table file_api uses some old style calls to db_get_table(..), similar to: db_get_table( 'mantis_bug_file_table' ) Instead of the newer argument format: db_get_table( 'bug_file' ); Signed-off-by: David Hicks <hickseydr@optusnet.com.au> |
Affected Issues 0012366 |
|
| mod - core/file_api.php | Diff File | ||
