Source Control Integration

master 246332d4 2010-12-25 22:54 dhx Details Diff	Issue 0012545: Remove deprecated <font> tags from XHTML output The old <font> HTML tag is deprecated and shouldn't be used.	Affected Issues 0012545
	mod - login_page.php	Diff File
	mod - admin/test_email.php	Diff File
	mod - admin/test_icons.php	Diff File
	mod - config_defaults_inc.php	Diff File
	mod - core/authentication_api.php	Diff File
	mod - core/print_api.php	Diff File
	mod - admin/install.php	Diff File
	mod - admin/test_langs.php	Diff File
master bac3bae9 2010-12-25 22:41 dhx Details Diff	Issue 0012545: Replace last remaining <br>'s with <br /> Required for strict XHTML output.	Affected Issues 0012545
	mod - admin/install.php	Diff File
	mod - admin/test_langs.php	Diff File
master 471900e2 2010-12-25 22:36 dhx Details Diff	Issue 0012545: Replace   with HTML5 compatible &0000160; Siebrand Mazeland already performed this conversion on the 1.2.x branch on November 1st 2010 as per commit a256ece0d679c906... These changes are required with the new XHTML strict ouput enforced in the 1.3.x branch. A bug existed with the date picker (jscalendar) where someelement.innerHTML was being set to ' ' - throwing up an error in Firefox 4.0 beta 9.	Affected Issues 0012545
	mod - signup_page.php	Diff File
	mod - print_all_bug_page_word.php	Diff File
	mod - account_sponsor_page.php	Diff File
	mod - plugins/MantisGraph/core/Period.php	Diff File
	mod - core/icon_api.php	Diff File
	mod - login_page.php	Diff File
	mod - bug_sponsorship_list_view_inc.php	Diff File
	mod - core/collapse_api.php	Diff File
	mod - print_bug_page.php	Diff File
	mod - query_view_page.php	Diff File
	mod - adm_config_report.php	Diff File
	mod - print_bugnote_inc.php	Diff File
	mod - manage_config_email_page.php	Diff File
	mod - manage_proj_page.php	Diff File
	mod - proj_doc_page.php	Diff File
	mod - manage_proj_cat_edit_page.php	Diff File
	mod - manage_custom_field_edit_page.php	Diff File
	mod - core/relationship_api.php	Diff File
	mod - core/print_api.php	Diff File
	mod - manage_user_page.php	Diff File
	mod - core/string_api.php	Diff File
	mod - manage_proj_ver_edit_page.php	Diff File
	mod - manage_config_work_threshold_page.php	Diff File
	mod - core/custom_function_api.php	Diff File
	mod - bug_view_inc.php	Diff File
	mod - docbook/Admin_Guide/en-US/Project_Management.xml	Diff File
	mod - docbook/Admin_Guide/en-US/Configuration.xml	Diff File
	mod - manage_plugin_page.php	Diff File
	mod - proj_doc_edit_page.php	Diff File
	mod - core/html_api.php	Diff File
	mod - view_all_inc.php	Diff File
	mod - manage_config_workflow_page.php	Diff File
	mod - adm_permissions_report.php	Diff File
	mod - core/columns_api.php	Diff File
	mod - lang/strings_ripoarisch.txt	Diff File
	mod - core/utility_api.php	Diff File
	mod - manage_proj_edit_page.php	Diff File
	mod - view_filters_page.php	Diff File
	mod - docbook/Admin_Guide/en-US/Page_Descriptions.xml	Diff File
	mod - lost_pwd_page.php	Diff File
	mod - core/filter_api.php	Diff File
	mod - print_all_bug_options_inc.php	Diff File
	mod - lang/strings_hungarian.txt	Diff File
	mod - bug_update_advanced_page.php	Diff File
	mod - javascript/jscalendar/calendar.js	Diff File
master e7ab3423 2010-12-25 22:11 dhx Details Diff	Update jQuery UI to v1.8.7
	mod - javascript/jquery-ui.js	Diff File
master cb5007da 2010-12-25 21:35 dhx Details Diff	Issue 0012545: Convert admin/check script to produce strict XHTML output The new administration check script at admin/check/index.php is already producing XHTML strict output. However, the Content-Type header and headers within the XHTML output itself were still set for traditional loose HTML output.	Affected Issues 0012545
	mod - admin/check/index.php	Diff File
master 7790835c 2010-12-25 21:26 dhx Details Diff	Issue 0012631: Replace old dynamic filter JavaScript code with jQuery MantisBT was using a very old and messy method for handling dynamic filters with client side JavaScript. This involved a lot of inline JavaScript throughout the HTML output which is blocking our progress towards bug 0011826 - completely removing all inline JavaScript from the HTML output. This patch removes the old dynamic filter JavaScript approach and replaces it with a smaller, faster, more reliable and easier to maintain jQuery equivalent.	Affected Issues 0011826, 0012631
	rm - javascript/dev/addLoadEvent.js	Diff
	mod - core/helper_api.php	Diff File
	mod - javascript/common.js	Diff File
	mod - docbook/Admin_Guide/en-US/Configuration.xml	Diff File
	rm - javascript/dynamic_filters.js	Diff
	mod - core/filter_api.php	Diff File
	mod - view_all_bug_page.php	Diff File
	mod - core/obsolete.php	Diff File
	rm - javascript/dev/dynamic_filters.js	Diff
	mod - core/print_api.php	Diff File
	mod - return_dynamic_filters.php	Diff File
	mod - lang/strings_english.txt	Diff File
	mod - admin/check/check_display_inc.php	Diff File
	rm - javascript/dev/xmlhttprequest.js	Diff
	rm - javascript/xmlhttprequest.js	Diff
	rm - javascript/addLoadEvent.js	Diff
	mod - view_filters_page.php	Diff File
	mod - config_defaults_inc.php	Diff File
master 0d602be5 2010-12-25 08:09 dhx Details Diff	Issue 0012545: Rewrite attachment listing and previewing The output printing of bug attachment listings used to use inline custom JavaScript code. This commit rewrites the printing of attachment lists to use collapse_api. collapse_api doesn't use inline JavaScript for collapsing/expanding content on the page.	Affected Issues 0011826, 0012545
	mod - core/print_api.php	Diff File
	mod - css/default.css	Diff File
	mod - core/collapse_api.php	Diff File
master e487d70f 2010-12-25 08:07 dhx Details Diff	Fix 0011738: Use an ASCII compatible session key Commit 1416aaf1343a7d2122a099a5e6feb1f847621f2d deprecated $g_session_key in favour of a unique key automatically derived from $g_crypto_master_salt. However a bug existed in this commit whereby the output of the hash() function was raw data, thus leading to failure of PHP sessions. We need to ensure that the session key is ASCII compatible.	Affected Issues 0011738
	mod - core/session_api.php	Diff File
master 1416aaf1 2010-12-25 04:20 dhx Details Diff	Issue 0011738: Deprecate $g_session_key configuration option We don't need to use a unique 'session_key' configuration option anymore as we can just derive a unique key from $g_crypto_master_salt.	Affected Issues 0011738
	mod - config_defaults_inc.php	Diff File
	mod - core/obsolete.php	Diff File
	mod - core/session_api.php	Diff File
master b565be1b 2010-12-25 04:03 dhx Details Diff	Fix 0011983: Remove duplicate Content-Type header for Excel export	Affected Issues 0011983
	mod - excel_xml_export.php	Diff File
master-1.2.x 095311d0 2010-12-25 04:03 dhx Details Diff	Fix 0011983: Remove duplicate Content-Type header for Excel export	Affected Issues 0011983
	mod - excel_xml_export.php	Diff File
master 987ec693 2010-12-25 04:00 dhx Details Diff	Fix 0012607: Remove unnecessary semi colon from Content-Type header	Affected Issues 0012607
	mod - admin/upgrade_unattended.php	Diff File
master-1.2.x e534936e 2010-12-25 04:00 dhx Details Diff	Fix 0012607: Remove unnecessary semi colon from Content-Type header	Affected Issues 0012607
	mod - admin/upgrade_unattended.php	Diff File
master 9b05114c 2010-12-25 03:10 dhx Details Diff	Fix 0012570: Invalid XHTML due to lack of escaping of attachment URL file_api returns attachment URLs in their raw unescaped format. Before placing these URLs inside the "href" attribute of an "a" element we must run it through string_attribute() first to escape ampersands and other unsafe characters. Within the same section of code a typo also existed with quotation marks accidentally being outputted around a "class" attribute on a span element. Thanks to Tamás Gulácsi for the initial patch and bug report.	Affected Issues 0012570
	mod - core/print_api.php	Diff File
master-1.2.x be42936b 2010-12-25 03:10 dhx Details Diff	Fix 0012570: Invalid XHTML due to lack of escaping of attachment URL file_api returns attachment URLs in their raw unescaped format. Before placing these URLs inside the "href" attribute of an "a" element we must run it through string_attribute() first to escape ampersands and other unsafe characters. Within the same section of code a typo also existed with quotation marks accidentally being outputted around a "class" attribute on a span element. Thanks to Tamás Gulácsi for the initial patch and bug report.	Affected Issues 0012570
	mod - core/print_api.php	Diff File
master b41af6ed 2010-12-25 02:51 dhx Details Diff	Fix 0012553: Improve handling of allow_*_own_attachments options There exists three existing options to allow users to view, download and delete their own attachments only (if they don't have wider permission to view, download and delete ANY attachment within a project). These options are: $g_allow_view_own_attachments $g_allow_download_own_attachments $g_allow_delete_own_attachments These options were not being factored into access checks correctly. Instead of checking who uploaded the attachment we were checking whether the current user is the reporter of the issue.... sometimes. It is important to note that the bug_get_attachments() function in bug_api.php no longer performs any access checks. It is up to the caller to filter the attachments and validate access permissions. Use file_get_visible_attachments() from file_api.php instead if you want to get a filtered list of attachments that factors in access levels. Thank you to Frank Rodgers for an intial patch and ideas on how to improve the handling of these options.	Affected Issues 0012553
	mod - api/soap/mc_issue_api.php	Diff File
	mod - file_download.php	Diff File
	mod - core/columns_api.php	Diff File
	mod - bug_view_inc.php	Diff File
	mod - core/file_api.php	Diff File
	mod - core/bug_api.php	Diff File
	mod - my_view_inc.php	Diff File
master-1.2.x 5e8e7e26 2010-12-25 02:51 dhx Details Diff	Fix 0012553: Improve handling of allow_*_own_attachments options There exists three existing options to allow users to view, download and delete their own attachments only (if they don't have wider permission to view, download and delete ANY attachment within a project). These options are: $g_allow_view_own_attachments $g_allow_download_own_attachments $g_allow_delete_own_attachments These options were not being factored into access checks correctly. Instead of checking who uploaded the attachment we were checking whether the current user is the reporter of the issue.... sometimes. It is important to note that the bug_get_attachments() function in bug_api.php no longer performs any access checks. It is up to the caller to filter the attachments and validate access permissions. Use file_get_visible_attachments() from file_api.php instead if you want to get a filtered list of attachments that factors in access levels. Thank you to Frank Rodgers for an intial patch and ideas on how to improve the handling of these options.	Affected Issues 0012553
	mod - core/bug_api.php	Diff File
	mod - core/columns_api.php	Diff File
	mod - core/file_api.php	Diff File
	mod - bug_view_inc.php	Diff File
	mod - my_view_inc.php	Diff File
	mod - api/soap/mc_issue_api.php	Diff File
	mod - file_download.php	Diff File
master bbcf0de0 2010-12-25 01:46 dhx Details Diff	Fix 0012568: Allow per-project control over visibility of tags/monitoring When printing the history of a bug we should apply visibility restrictions on a per-project basis so that people can specify that users can see the monitor list (or tags) in one project but not another.	Affected Issues 0012568
	mod - core/history_api.php	Diff File
master-1.2.x ac713ec7 2010-12-25 01:46 dhx Details Diff	Fix 0012568: Allow per-project control over visibility of tags/monitoring When printing the history of a bug we should apply visibility restrictions on a per-project basis so that people can specify that users can see the monitor list (or tags) in one project but not another.	Affected Issues 0012568
	mod - core/history_api.php	Diff File
master 3574fa69 2010-12-24 23:45 dhx Details Diff	Fix 0012545: print_bug_page.php doesn't close <body> and <html> tags The HTML page output for print_bug_page.php terminates on a closing </table> tag. The <body> and <html> tags also needing closing for the page to produce well formed XHTML output.	Affected Issues 0012545
	mod - print_bug_page.php	Diff File
master-1.2.x be34e61f 2010-12-24 23:45 dhx Details Diff	Fix 0012545: print_bug_page.php doesn't close <body> and <html> tags The HTML page output for print_bug_page.php terminates on a closing </table> tag. The <body> and <html> tags also needing closing for the page to produce well formed XHTML output.	Affected Issues 0012545
	mod - print_bug_page.php	Diff File
master eb38db49 2010-12-24 23:29 dhx Details Diff	Fix 0012630: print_bugnote_inc.php XSS with unescaped reminder usernames A minor XSS issue exists with print_bugnote_inc.php whereby usernames are not properly sanitised prior to being outputted. Steps to reproduce: 1. Create a user with a username of "Hack<script>alert(1)</script>" (note: MantisBT will not let people create these malformed usernames by default as only latin characters are accepted, therefore you must create the user with SQL or another raw approach). 2. Send a reminder to this new user from inside a bug. 3. Go to the print view of the bug. 4. Notice an alert window pop up indicating an XSS issue. NOTE: This is not a major security issue because MantisBT prevents people from making malformed usernames by default. It's only an issue if you're adding users to MantisBT using your own approach (a third party user creation script) and writing directly to the database instead of using MantisBT's API.	Affected Issues 0012630
	mod - print_bugnote_inc.php	Diff File
master-1.2.x 92a3e685 2010-12-24 23:29 dhx Details Diff	Fix 0012630: print_bugnote_inc.php XSS with unescaped reminder usernames A minor XSS issue exists with print_bugnote_inc.php whereby usernames are not properly sanitised prior to being outputted. Steps to reproduce: 1. Create a user with a username of "Hack<script>alert(1)</script>" (note: MantisBT will not let people create these malformed usernames by default as only latin characters are accepted, therefore you must create the user with SQL or another raw approach). 2. Send a reminder to this new user from inside a bug. 3. Go to the print view of the bug. 4. Notice an alert window pop up indicating an XSS issue. NOTE: This is not a major security issue because MantisBT prevents people from making malformed usernames by default. It's only an issue if you're adding users to MantisBT using your own approach (a third party user creation script) and writing directly to the database instead of using MantisBT's API.	Affected Issues 0012630
	mod - print_bugnote_inc.php	Diff File
master 9785504e 2010-12-24 23:09 dhx Details Diff	Fix 0012610: my_view_page missing closing </tr> tag Due to a flaw in the logic/counting system used for laying out boxes on my_view_page, sometimes a </tr> tag was missing. This causes problems when using MantisBT in XHTML strict mode.	Affected Issues 0012610
	mod - my_view_page.php	Diff File
master-1.2.x 68e701ff 2010-12-24 23:09 dhx Details Diff	Fix 0012610: my_view_page missing closing </tr> tag Due to a flaw in the logic/counting system used for laying out boxes on my_view_page, sometimes a </tr> tag was missing. This causes problems when using MantisBT in XHTML strict mode.	Affected Issues 0012610
	mod - my_view_page.php	Diff File

Changesets: MantisBT