Source Control Integration

master 3c6e93b6 2010-08-10 08:59 dhx Details Diff	Fix 0011919: Typo prevents copying of users between projects A typo introduced with the patch for issue 0011530 prevented the copy users from project A to project B feature from working. Thanks to watergad for this patch.	Affected Issues 0011530, 0011919
	mod - manage_proj_user_copy.php	Diff File
master-1.2.x c6a1dd35 2010-08-10 08:59 dhx Details Diff	Fix 0011919: Typo prevents copying of users between projects A typo introduced with the patch for issue 0011530 prevented the copy users from project A to project B feature from working. Thanks to watergad for this patch.	Affected Issues 0011530, 0011919
	mod - manage_proj_user_copy.php	Diff File
master 1bb63b55 2010-08-10 08:37 dhx Details Diff	Fix incorrect jQuery syntax in bugFilter.js Commit b77ea9cd2333f1549eea03f020da574747a2a855 reverted the jQuery syntax back to $(...) instead of $j(...) however bugFilter.js wasn't updated to match the "new" syntax. The bug filter JavaScript functionality should now work again.
	mod - javascript/dev/bugFilter.js	Diff File
master 919cd8f0 2010-08-07 02:53 dhx Details Diff	Issue 0012245: Remove extended project browser feature The extended project browser feature consists of two combo boxes (one for the tier 1 projects and one for the tier 2 projects). Extensive JavaScript is used to link the two combo boxes together so that changing the tier 1 project refreshes the tier 2 project list. This approach suffers from a number of issues: 1) It doesn't escape potentially harmful values before inserting them within the JavaScript. 2) It uses inline JavaScript which we're avoiding due to 0011826. 3) It doesn't scale beyond 2 levels of projects (project and sub-projects). 4) When enabled there is no fallback mechanism for JavaScript-disabled browsers. Therefore this feature should be deprecated, removed and replaced in the future with a superior and more modern alternative.	Affected Issues 0012245
	mod - core/html_api.php	Diff File
	mod - docbook/adminguide/en/configuration.sgml	Diff File
	mod - config_defaults_inc.php	Diff File
	mod - core/print_api.php	Diff File
master 549acf42 2010-08-07 02:29 dhx Details Diff	Consistently indent JavaScript includes within <head>
	mod - core/html_api.php	Diff File
master ed89d160 2010-08-07 02:19 dhx Details Diff	Add security warning comment to javascript_config.php Future developers need to be aware of the consequences of exposing configuration values using this JavaScript interface.
	mod - javascript_config.php	Diff File
master 8c18b0ee 2010-08-07 02:03 dhx Details Diff	Issue 0011826: Replace inline JavaScript datetime picker The JavaScript date/time picker control was being loaded inline within the body of the HTML output. An upgraded MantisBT core can now handle loading or scripts and stylesheets more gracefully using new require_js and require_css functions. This allows us to remove a bunch of inline JavaScript thus progressing towards full implementation of X-Content-Security-Policy. jQuery is used to search the document on load for any text input fields with the class "datetime". For each field found, a datetime picker icon/button is created next to the input box. Users can click this icon (as they could before) to show the jsCalendar widget (which remains unchanged).	Affected Issues 0011826
	mod - bug_change_status_page.php	Diff File
	mod - bug_update_advanced_page.php	Diff File
	mod - javascript/dev/common.js	Diff File
	mod - manage_proj_ver_edit_page.php	Diff File
	mod - bug_report_page.php	Diff File
	mod - core/date_api.php	Diff File
master 1dbe709e 2010-08-07 01:58 dhx Details Diff	Issue 0011826: Implement new loading functions for CSS and JS Two new functions have been added so that MantisBT pages can inform the MantisBT core (html_api.php in particular) which JavaScript files and stylesheets to load during the output HTML rendering. These functions must be used PRIOR to html_top() being executed as after that point of time it'll be too late to load new scripts or stylesheets. This functionality will prevent multiple inclusions of the same JavaScript file and will also prevent the need for downloading a new stylesheet or script half way through the rendering of the page within the user's browser.	Affected Issues 0011826
	mod - core/html_api.php	Diff File
master bba266b1 2010-08-07 01:54 dhx Details Diff	Issue 0011826: Add dynamic JavaScript configuration script This script is loaded prior to any other scripts and will allow all scripts to read selected MantisBT configuration values.	Affected Issues 0011826
	add - javascript_config.php	Diff File
master 23d6e569 2010-08-07 00:10 dhx Details Diff	Add missing ezC Graph files Some files were missing from our bundled version of ezC Graph. These have now been included (even if we don't necessarily make use of them).
	add - library/ezc/Graph/src/interfaces/horizontal_bar_renderer.php	Diff File
	add - library/ezc/Graph/src/renderer/axis_label_rotated_boxed.php	Diff File
	add - library/ezc/Graph/src/renderer/horizontal_bar.php	Diff File
	add - library/ezc/Base/src/interfaces/exportable.php	Diff File
	add - library/ezc/Graph/src/driver/cairo_oo.php	Diff File
	add - library/ezc/Graph/src/charts/horizontal_bar.php	Diff File
master-1.2.x aa9ba88b 2010-08-07 00:10 dhx Details Diff	Add missing ezC Graph files Some files were missing from our bundled version of ezC Graph. These have now been included (even if we don't necessarily make use of them).
	add - library/ezc/Graph/src/interfaces/horizontal_bar_renderer.php	Diff File
	add - library/ezc/Graph/src/renderer/axis_label_rotated_boxed.php	Diff File
	add - library/ezc/Graph/src/renderer/horizontal_bar.php	Diff File
	add - library/ezc/Base/src/interfaces/exportable.php	Diff File
	add - library/ezc/Graph/src/driver/cairo_oo.php	Diff File
	add - library/ezc/Graph/src/charts/horizontal_bar.php	Diff File
master 24e117c5 2010-08-05 09:44 dhx Details Diff	Fix type of jQuery files from symlink to file Commit cc87385166f6d3b5a84fc6073195131f51e8b317 removed jQuery symlinks from the repository. However, the replacement files still had the wrong type and were being treated as symlinks instead of files.
master a4e6b210 2010-08-05 09:14 dhx Details Diff	Fix 0011930: Fix unused/new prefix filters on manage users page The UNUSED and NEW prefix filters on the manage users page were broken due to use of a translated language string as a lookup key. This has now been fixed to use constant keys "UNUSED" and "NEW" regardless of language used.	Affected Issues 0011930
	mod - manage_user_page.php	Diff File
master-1.2.x 94aaca80 2010-08-05 09:14 dhx Details Diff	Fix 0011930: Fix unused/new prefix filters on manage users page The UNUSED and NEW prefix filters on the manage users page were broken due to use of a translated language string as a lookup key. This has now been fixed to use constant keys "UNUSED" and "NEW" regardless of language used.	Affected Issues 0011930
	mod - manage_user_page.php	Diff File
master 0cad50d7 2010-08-05 07:09 grangeway Details Diff	Merge branch 'master' of mantisbt.org:mantisbt
master 23b1d934 2010-08-05 04:35 dhx Details Diff	Fix 0011852: Forgotton password feature prevents admin password reset When the forgotton password feature is turned off in config_inc.php this removes the [Forgotton Password] link from the login page. It also has the unintented side effect of preventing e-mails being sent out for a password reset through the Management console. This is caused by the use of 'lost_password_feature' in an if clause in email_api.php. Thanks to Alex Russell (xavierblue) for this patch.	Affected Issues 0011852
	mod - core/email_api.php	Diff File
master-1.2.x 5709cc99 2010-08-05 04:35 dhx Details Diff	Fix 0011852: Forgotton password feature prevents admin password reset When the forgotton password feature is turned off in config_inc.php this removes the [Forgotton Password] link from the login page. It also has the unintented side effect of preventing e-mails being sent out for a password reset through the Management console. This is caused by the use of 'lost_password_feature' in an if clause in email_api.php. Thanks to Alex Russell (xavierblue) for this patch.	Affected Issues 0011852
	mod - core/email_api.php	Diff File
master bfc9e9ff 2010-08-05 04:00 dhx Details Diff	Fix 0012238: XSS in print_all_bug_page_word.php project/category names print_all_bug_page_word.php does not correctly sanitise project and category names. It is thus possible for a malicious user with project manager access permissions (or higher) to redirect users to print_all_bug_page_word.php to execute malicious JavaScript.	Affected Issues 0012238
	mod - print_all_bug_page_word.php	Diff File
master-1.2.x 9fc1dd81 2010-08-05 04:00 dhx Details Diff	Fix 0012238: XSS in print_all_bug_page_word.php project/category names print_all_bug_page_word.php does not correctly sanitise project and category names. It is thus possible for a malicious user with project manager access permissions (or higher) to redirect users to print_all_bug_page_word.php to execute malicious JavaScript.	Affected Issues 0012238
	mod - print_all_bug_page_word.php	Diff File
master 7ab71d01 2010-08-04 10:05 dhx Details Diff	Fix 0012232: Multiple XSS issues with custom field enumeration values MantisBT administrators (who can configure custom fields) can place malicious Javascript within the options they define for custom field enumeration/checkbox/radio/etc field types. These HTML-unsafe options are then printed to users throughout MantisBT (report, update, view, etc) without sanitisation. This is low risk due to the need to be a MantisBT administrator to configure custom field values. Rather than being a pure security risk, this is more a case of allowing all characters to be used safely within custom field options.	Affected Issues 0012232
	mod - core/cfdefs/cfdef_standard.php	Diff File
master-1.2.x 243ff6f6 2010-08-04 10:05 dhx Details Diff	Fix 0012232: Multiple XSS issues with custom field enumeration values MantisBT administrators (who can configure custom fields) can place malicious Javascript within the options they define for custom field enumeration/checkbox/radio/etc field types. These HTML-unsafe options are then printed to users throughout MantisBT (report, update, view, etc) without sanitisation. This is low risk due to the need to be a MantisBT administrator to configure custom field values. Rather than being a pure security risk, this is more a case of allowing all characters to be used safely within custom field options.	Affected Issues 0012232
	mod - core/cfdefs/cfdef_standard.php	Diff File
master 2e397700 2010-08-04 09:23 dhx Details Diff	Fix 0012231: XSS vulnerability when uninstalling badly named plugins John Reese discovered an XSS vulnerability with the uninstall confirmation message shown when plugins are being uninstalled. The plugin name is not escaped before being outputted and thus HTML unsafe characters are not sanitised. This doesn't actually pose a security risk because it requires someone to: a) Have access to the server to rename a plugin in the PHP files b) Have administrator access to the MantisBT installation	Affected Issues 0012231
	mod - manage_plugin_uninstall.php	Diff File
master-1.2.x f60d0cfb 2010-08-04 09:23 dhx Details Diff	Fix 0012231: XSS vulnerability when uninstalling badly named plugins John Reese discovered an XSS vulnerability with the uninstall confirmation message shown when plugins are being uninstalled. The plugin name is not escaped before being outputted and thus HTML unsafe characters are not sanitised. This doesn't actually pose a security risk because it requires someone to: a) Have access to the server to rename a plugin in the PHP files b) Have administrator access to the MantisBT installation	Affected Issues 0012231
	mod - manage_plugin_uninstall.php	Diff File
master 083c34f0 2010-08-04 09:17 dhx Details Diff	Fix 0012230: XSS vulnerability when deleting maliciously named categories As reported by Secunia, SA40832, there is an XSS vulnerability when deleting project categories that have been maliciously named. The chance of attack is low due to requiring project manager access to create malicious project categories in the first place. Thanks to John Reese for debugging this issue.	Affected Issues 0012230
	mod - manage_proj_cat_delete.php	Diff File
master-1.2.x a374a7c9 2010-08-04 09:17 dhx Details Diff	Fix 0012230: XSS vulnerability when deleting maliciously named categories As reported by Secunia, SA40832, there is an XSS vulnerability when deleting project categories that have been maliciously named. The chance of attack is low due to requiring project manager access to create malicious project categories in the first place. Thanks to John Reese for debugging this issue.	Affected Issues 0012230
	mod - manage_proj_cat_delete.php	Diff File

Changesets: MantisBT