Source Control Integration

master 532b0501 2010-06-21 13:43 jreese Details Diff	Migrate from existing usages to form_action_self()
	mod - manage_config_workflow_page.php	Diff File
	mod - manage_config_work_threshold_page.php	Diff File
	mod - manage_config_email_page.php	Diff File
	mod - core/helper_api.php	Diff File
	mod - bugnote_stats_inc.php	Diff File
	mod - billing_inc.php	Diff File
	mod - core/authentication_api.php	Diff File
master-1.2.x c98310c1 2010-06-21 13:43 jreese Details Diff	Migrate from existing usages to form_action_self()
	mod - core/authentication_api.php	Diff File
	mod - bugnote_stats_inc.php	Diff File
	mod - manage_config_workflow_page.php	Diff File
	mod - core/helper_api.php	Diff File
	mod - billing_inc.php	Diff File
	mod - manage_config_work_threshold_page.php	Diff File
	mod - manage_config_email_page.php	Diff File
master 9d357c23 2010-06-21 13:43 jreese Details Diff	Added form_action_self() API function Helper function to generate a form action value when forms are designed to be submitted to the same url that's is currently being used, such as helper_ensure_confirmed() or auth_reauthenticate(). Designed to fix issues with using reverse proxies that rewrite URLs for the application server. By using a standard self-relative form action, it prevents issues where SCRIPT_NAME on the application server does not match the URL that the client is using.
	mod - core/form_api.php	Diff File
master-1.2.x 193f3be7 2010-06-21 13:43 jreese Details Diff	Added form_action_self() API function Helper function to generate a form action value when forms are designed to be submitted to the same url that's is currently being used, such as helper_ensure_confirmed() or auth_reauthenticate(). Designed to fix issues with using reverse proxies that rewrite URLs for the application server. By using a standard self-relative form action, it prevents issues where SCRIPT_NAME on the application server does not match the URL that the client is using.
	mod - core/form_api.php	Diff File
master 4c791523 2010-06-19 00:38 dhx Details Diff	Issue 0012096: Add reporter and handler to monitor list on duplicate When an issue X is resolved as a duplicate of an existing issue Y, the monitor list from X is copied to and merged with Y. However the reporter and handler of the source issue are not copied unless they're on the monitor list. This change ensures that the reporter and handler of the source issue are added to the monitor list on the destination issue. These users are thus less likely to become out-of-the-loop on an issue that is relevant to them.	Affected Issues 0012096
	mod - core/bug_api.php	Diff File
master 69c55f95 2010-06-19 00:22 dhx Details Diff	Fix 0012095: bug_monitor_copy() should check users exist bug_monitor_copy() assumes that all user IDs from the source bug are still valid. We should first check to make sure that users from the source bug still exist before adding them to the monitor list of the destination bug.	Affected Issues 0012095
	mod - core/bug_api.php	Diff File
master fdaef4f8 2010-06-18 23:22 dhx Details Diff	Add new error ERROR_BUG_RESOLVE_DEPENDANTS_BLOCKING A new error message is needed to describe the situation where a user is attempting to resolve/close an issue which has outstanding dependant issues.
	mod - core/constant_inc.php	Diff File
	mod - lang/strings_english.txt	Diff File
master ecc102ed 2010-06-18 23:16 dhx Details Diff	Fix 0012094: ERROR_BUG_READ_ONLY_ACTION_DENIED is not obsoleted ERROR_BUG_READ_ONLY_ACTION_DENIED is marked as obsolete when it isn't obsolete at all - it's used in many places throughout the MantisBT codebase. On the other hand ERROR_BUG_RESOLVED_ACTION_DENIED isn't used anywhere within the MantisBT codebase and no language strings exist for this error code.	Affected Issues 0012094
	mod - core/constant_inc.php	Diff File
master 1819bbdf 2010-06-10 01:49 daryn Details Diff	Add html_css_link function and convert hardcoded links to use the function. Remove the css directory from the css configuration options in config_defaults_inc.php. The new function adds the css directory. Add jquery-ui files so we can add datepicker and other items as necessary.
	add - css/images/ui-anim_basic_16x16.gif	Diff File
	add - css/images/ui-icons_2e83ff_256x240.png	Diff File
	add - css/images/ui-icons_72a7cf_256x240.png	Diff File
	add - css/images/ui-bg_highlight-soft_25_ffef8f_1x100.png	Diff File
	add - css/images/ui-bg_inset-soft_95_fef1ec_1x100.png	Diff File
	add - css/images/ui-bg_highlight-soft_100_deedf7_1x100.png	Diff File
	mod - config_defaults_inc.php	Diff File
	add - css/images/ui-bg_highlight-hard_100_f2f5f7_1x100.png	Diff File
	add - css/images/ui-icons_cd0a0a_256x240.png	Diff File
	add - css/images/ui-bg_inset-hard_100_fcfdfd_1x100.png	Diff File
	add - css/jquery-ui-1.8.2.css	Diff File
	add - css/images/ui-bg_glass_65_ffffff_1x400.png	Diff File
	add - css/images/ui-icons_ffffff_256x240.png	Diff File
	add - css/images/ui-bg_glass_95_fef1ec_1x400.png	Diff File
	add - css/images/ui-bg_flat_55_fbec88_40x100.png	Diff File
	add - css/images/ui-bg_flat_75_e8e8e8_40x100.png	Diff File
	add - css/images/ui-bg_inset-hard_100_f5f8f9_1x100.png	Diff File
	add - css/images/ui-icons_999999_256x240.png	Diff File
	add - css/images/ui-icons_3d80b3_256x240.png	Diff File
	add - css/images/ui-icons_454545_256x240.png	Diff File
	add - css/images/ui-bg_glass_75_dadada_1x400.png	Diff File
	add - css/images/ui-bg_flat_0_aaaaaa_40x100.png	Diff File
	add - css/images/ui-bg_glass_65_c8c8e8_1x400.png	Diff File
	add - css/images/ui-bg_diagonals-thick_90_eeeeee_40x40.png	Diff File
	add - css/images/ui-icons_888888_256x240.png	Diff File
	add - css/images/ui-icons_217bc0_256x240.png	Diff File
	add - css/images/ui-bg_glass_100_e4f1fb_1x400.png	Diff File
	add - css/images/ui-bg_glass_0_c8c8e8_1x400.png	Diff File
	add - css/images/ui-bg_flat_15_cd0a0a_40x100.png	Diff File
	add - css/images/ui-bg_glass_85_dfeffc_1x400.png	Diff File
	add - css/images/ui-bg_highlight-soft_75_cccccc_1x100.png	Diff File
	add - css/images/ui-bg_gloss-wave_55_5c9ccc_500x100.png	Diff File
	add - css/images/ui-bg_highlight-soft_75_c8c8e8_1x100.png	Diff File
	add - css/images/ui-bg_glass_75_e6e6e6_1x400.png	Diff File
	add - css/images/ui-bg_glass_55_fff9d3_1x400.png	Diff File
	add - css/images/ui-icons_6da8d5_256x240.png	Diff File
	add - css/images/ui-bg_glass_75_d0e5f5_1x400.png	Diff File
	mod - core/html_api.php	Diff File
	add - css/images/ui-bg_flat_75_ffffff_40x100.png	Diff File
	add - css/images/ui-icons_d8e7f3_256x240.png	Diff File
	add - css/images/ui-bg_glass_55_fbf9ee_1x400.png	Diff File
	add - css/images/ui-icons_222222_256x240.png	Diff File
	add - css/images/ui-bg_glass_50_3baae3_1x400.png	Diff File
	add - css/images/ui-icons_469bdd_256x240.png	Diff File
	add - javascript/dev/jquery-ui-1.8.2.js	Diff File
	add - javascript/min/jquery-ui-1.8.2.js	Diff File
	add - css/images/ui-icons_f9bd01_256x240.png	Diff File
	add - javascript/dev/jquery-ui.js	Diff File
	add - javascript/min/jquery-ui.js	Diff File
	add - css/images/ui-bg_glass_75_c8c8e8_1x400.png	Diff File
	add - css/images/ui-bg_highlight-hard_70_000000_1x100.png	Diff File
	add - css/images/ui-bg_glass_80_d7ebf9_1x400.png	Diff File
	add - css/jquery-ui.css	Diff File
	add - css/images/ui-icons_2694e8_256x240.png	Diff File
master 2dc8409e 2010-06-10 01:00 daryn Details Diff	Remove ToggleDiv call from the html and add jquery listener. Modify to use jquery calls rather than dom calls. Add classes so the listener can be added for all collapsible divs at once.	Affected Issues 0011826
	mod - javascript/min/common.js	Diff File
	mod - javascript/dev/common.js	Diff File
	mod - core/collapse_api.php	Diff File
master b4038b50 2010-06-09 16:22 daryn Details Diff	Load common.js after jquery conflicts have been resolved. Remove tal attribute inadvertently left in from template branch. Rename minified jquery to indicate the version. Add symbolic link and use the symbolic link for ease of upgrades.
	add - javascript/dev/jquery.js	Diff File
	add - javascript/min/jquery.js	Diff File
	mod - core/html_api.php	Diff File
master-1.2.x 823658eb 2010-06-03 19:30 siebrand Details Diff	Localisation updates from http://translatewiki.net Signed-off-by: Siebrand Mazeland <s.mazeland@xs4all.nl>
	mod - lang/strings_german.txt	Diff File
	mod - lang/strings_afrikaans.txt	Diff File
	add - plugins/XmlImportExport/lang/strings_tagalog.txt	Diff File
	mod - lang/strings_portuguese_brazil.txt	Diff File
	mod - lang/strings_macedonian.txt	Diff File
	add - plugins/MantisCoreFormatting/lang/strings_tagalog.txt	Diff File
	mod - lang/strings_tagalog.txt	Diff File
	mod - plugins/MantisGraph/lang/strings_tagalog.txt	Diff File
	mod - lang/strings_slovene.txt	Diff File
	mod - lang/strings_bulgarian.txt	Diff File
	mod - lang/strings_spanish.txt	Diff File
	mod - lang/strings_romanian.txt	Diff File
	mod - lang/strings_french.txt	Diff File
	mod - lang/strings_serbian.txt	Diff File
	mod - lang/strings_galician.txt	Diff File
	mod - lang/strings_hungarian.txt	Diff File
	add - plugins/MantisCoreFormatting/lang/strings_bulgarian.txt	Diff File
	mod - lang/strings_japanese.txt	Diff File
	mod - lang/strings_breton.txt	Diff File
master 25e8a533 2010-06-03 04:59 nerville Committer: rombert Details Diff	Update project description, status, name of a specific project using SOAP API Fixes 0011913 Signed-off-by: Robert Munteanu <robert.munteanu@gmail.com>	Affected Issues 0011913
	mod - tests/soap/AllTests.php	Diff File
	add - tests/soap/ProjectTest.php	Diff File
	mod - api/soap/mantisconnect.php	Diff File
	mod - api/soap/mc_project_api.php	Diff File
master-1.2.x da9a8eff 2010-06-03 04:59 nerville Committer: rombert Details Diff	Update project description, status, name of a specific project using SOAP API Fixes 0011913 Signed-off-by: Robert Munteanu <robert.munteanu@gmail.com>	Affected Issues 0011913
	mod - api/soap/mc_project_api.php	Diff File
	add - tests/soap/ProjectTest.php	Diff File
	mod - api/soap/mantisconnect.php	Diff File
	mod - tests/soap/AllTests.php	Diff File
master f653c1fc 2010-05-23 06:38 dhx Details Diff	Fix grammer in comment regarding attachment security Commit f017e817762b3348d8c36f17324f07a62393656f had a typo within one of the new code comment blocks.
	mod - file_download.php	Diff File
master-1.2.x 05a18494 2010-05-23 06:38 dhx Details Diff	Fix grammer in comment regarding attachment security Commit f017e817762b3348d8c36f17324f07a62393656f had a typo within one of the new code comment blocks.
	mod - file_download.php	Diff File
master 5eaec26d 2010-05-23 06:10 dhx Details Diff	Send HTTP security headers (CSP, etc) on file downloads File downloads should return HTTP security headers as another layer of protection against someone framing a MantisBT file_download link to a file with a harmful MIME type such as text/html.
	mod - file_download.php	Diff File
master-1.2.x 5c47bc14 2010-05-23 06:10 dhx Details Diff	Send HTTP security headers (CSP, etc) on file downloads File downloads should return HTTP security headers as another layer of protection against someone framing a MantisBT file_download link to a file with a harmful MIME type such as text/html.
	mod - file_download.php	Diff File
master f017e817 2010-05-23 05:38 dhx Details Diff	Fix 0011952: Arbitrary inline attachment rendering (security issue) Kornel Lesinski reported a significant security problem with Mantis' handling of attachments and MIME types. A user could upload a HTML file renamed to .gif and MantisBT would use Fileinfo to calculate the actual MIME type to be text/html. This is a problem because a user could be directed to click on a link purporting to be a .gif attachment when in fact it is a HTML document. Browsers would attempt to render the text/html attachment within the browser instead of treating it as a file download (or even just plaintext). Internet Explorer exaggerates this problem by ignoring the Content-Type header so that it can perform its own analysis of the file type. With the expectation that Fileinfo and any browser MIME detection are inherently insecure and unpredictable, we don't want to allow users to upload random files that could be misinterpreted by MIME detectors for malicious purposes. As we send our own Content-Type headers where appropriate, we can tell Internet Explorer 8+ to stop it's own MIME type sniffing, resulting in a performance boost for IE8+ users. To solve this problem, a new 'show_inline' parameter has been introduced to file_download.php which serves the purpose of specifying whether the file should be served to the user as an attachment (within the Content-Disposition header) or as an inline file that can be rendered within the browser. This parameter has also been protected using a CSRF token to ensure that cross-domain attacks are not possible whereby a malicious user uploads a HTML document and sends a link to someone else with &show_inline=1 set. This is particularly an issue where an attacker places a MantisBT instance within an invisible iframe such that the HTML attachment is rendered unknown to users (and this HTML attachment could invoke JavaScript to do nasty things within the domain of the MantisBT installation). In summary, MantisBT will treat all attachments as file downloads when it prepares the Content-Disposition header. An exception currently exists for inline image previews where MantisBT will create img src URLs that point to file_download.php with show_inline=1 and a CSRF token parameter provided. The MIME type isn't a significant concern in this case as browsers won't try to render HTML where an image is expected.	Affected Issues 0011952
	mod - core/http_api.php	Diff File
	mod - core/print_api.php	Diff File
	mod - file_download.php	Diff File
	mod - core/file_api.php	Diff File
master-1.2.x 618f45ac 2010-05-23 05:38 dhx Details Diff	Fix 0011952: Arbitrary inline attachment rendering (security issue) Kornel Lesinski reported a significant security problem with Mantis' handling of attachments and MIME types. A user could upload a HTML file renamed to .gif and MantisBT would use Fileinfo to calculate the actual MIME type to be text/html. This is a problem because a user could be directed to click on a link purporting to be a .gif attachment when in fact it is a HTML document. Browsers would attempt to render the text/html attachment within the browser instead of treating it as a file download (or even just plaintext). Internet Explorer exaggerates this problem by ignoring the Content-Type header so that it can perform its own analysis of the file type. With the expectation that Fileinfo and any browser MIME detection are inherently insecure and unpredictable, we don't want to allow users to upload random files that could be misinterpreted by MIME detectors for malicious purposes. As we send our own Content-Type headers where appropriate, we can tell Internet Explorer 8+ to stop it's own MIME type sniffing, resulting in a performance boost for IE8+ users. To solve this problem, a new 'show_inline' parameter has been introduced to file_download.php which serves the purpose of specifying whether the file should be served to the user as an attachment (within the Content-Disposition header) or as an inline file that can be rendered within the browser. This parameter has also been protected using a CSRF token to ensure that cross-domain attacks are not possible whereby a malicious user uploads a HTML document and sends a link to someone else with &show_inline=1 set. This is particularly an issue where an attacker places a MantisBT instance within an invisible iframe such that the HTML attachment is rendered unknown to users (and this HTML attachment could invoke JavaScript to do nasty things within the domain of the MantisBT installation). In summary, MantisBT will treat all attachments as file downloads when it prepares the Content-Disposition header. An exception currently exists for inline image previews where MantisBT will create img src URLs that point to file_download.php with show_inline=1 and a CSRF token parameter provided. The MIME type isn't a significant concern in this case as browsers won't try to render HTML where an image is expected.	Affected Issues 0011952
	mod - file_download.php	Diff File
	mod - core/file_api.php	Diff File
	mod - core/print_api.php	Diff File
	mod - core/http_api.php	Diff File
master 8bf42a62 2010-05-18 10:10 dhx Details Diff	Fix $t_path variable not found error from last commit The forward port of 782a7e03817cfdc345456af4ee4811eb8866d2b6 was incorrect as it removed a line of code that was essential. My bad!
	mod - config_defaults_inc.php	Diff File
master dc434fe1 2010-05-18 09:55 dhx Details Diff	Add missing files from ADOdb 5.11 Commit b8b21142be9e05232afada2e601f6c84ad0cd396 forgot to add new files in the ADOdb 5.11 release.
	add - library/adodb/datadict/datadict-sqlite.inc.php	Diff File
	add - library/adodb/drivers/adodb-db2ora.inc.php	Diff File
master-1.2.x 9c11ec9c 2010-05-18 08:19 jreese Details Diff	Fix CSS issues in /mantisbt/admin/	Affected Issues 0011917
	mod - config_defaults_inc.php	Diff File
master 782a7e03 2010-05-18 08:19 jreese Committer: dhx Details Diff	Fix CSS issues in /mantisbt/admin/ Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0011917
	mod - config_defaults_inc.php	Diff File
master b4e8a664 2010-05-17 21:27 jreese Details Diff	Fix edge case with event_clear_callbacks In cases where an error would occur before Mantis had fully bootstrapped, it was possible for the error API to generate misleading errors when the event API had not yet been loaded. By wrapping the call to event_clear_callbacks() with a check for function_exists(), it should fix this sort of behavior.
	mod - core/error_api.php	Diff File

Changesets: MantisBT