Source Control Integration

master-1.2.x 822e50d6 2010-11-09 05:55 cproensa Committer: dhx Details Diff	Fix 0012443: Moving bugs - check for reporter permissions in destination project The user with enough rights to move a bug into another project, is allowed to move it into a project in which he has only 'viewer' rights. Steps to reproduce this bug: 1. User has full rights in project A (enough to report and move bugs) 2. User has 'viewer' right in project B 3. User creates a bug in project A and is allowed to move it into project B Signed-off-by: David Hicks <d@hx.id.au>	Affected Issues 0012443
	mod - bug_actiongroup.php	Diff File
master a9032400 2010-11-08 21:55 cproensa Details Diff	Fix 0012443: Moving bugs - check for reporter permissions in destination project The user with enough rights to move a bug into another project, is allowed to move it into a project in which he has only 'viewer' rights. Steps to reproduce this bug: 1. User has full rights in project A (enough to report and move bugs) 2. User has 'viewer' right in project B 3. User creates a bug in project A and is allowed to move it into project B Signed-off-by: David Hicks <d@hx.id.au>	Affected Issues 0012443
	mod - bug_actiongroup.php	Diff File
master-1.2.x e36f7c6b 2010-11-07 15:48 siebrand Details Diff	Localisation updates from translatewiki.net.
	mod - lang/strings_italian.txt	Diff File
	mod - lang/strings_arabic.txt	Diff File
	mod - lang/strings_russian.txt	Diff File
	mod - lang/strings_german.txt	Diff File
	mod - lang/strings_hungarian.txt	Diff File
	mod - lang/strings_danish.txt	Diff File
	mod - lang/strings_czech.txt	Diff File
	mod - lang/strings_dutch.txt	Diff File
	mod - lang/strings_icelandic.txt	Diff File
	mod - lang/strings_japanese.txt	Diff File
	mod - lang/strings_korean.txt	Diff File
	mod - lang/strings_portuguese_brazil.txt	Diff File
	mod - lang/strings_breton.txt	Diff File
	mod - lang/strings_romanian.txt	Diff File
	mod - lang/strings_french.txt	Diff File
	mod - lang/strings_lithuanian.txt	Diff File
	mod - lang/strings_swedish.txt	Diff File
	mod - lang/strings_urdu.txt	Diff File
	mod - lang/strings_chinese_traditional.txt	Diff File
	mod - lang/strings_hebrew.txt	Diff File
	mod - lang/strings_arabicegyptianspoken.txt	Diff File
	mod - lang/strings_spanish.txt	Diff File
	mod - lang/strings_catalan.txt	Diff File
	mod - lang/strings_slovak.txt	Diff File
	mod - lang/strings_interlingua.txt	Diff File
	mod - lang/strings_portuguese_standard.txt	Diff File
	mod - lang/strings_macedonian.txt	Diff File
	mod - lang/strings_swissgerman.txt	Diff File
	mod - lang/strings_belarusian_tarask.txt	Diff File
	mod - lang/strings_occitan.txt	Diff File
	mod - lang/strings_chinese_simplified.txt	Diff File
	mod - lang/strings_bulgarian.txt	Diff File
	mod - lang/strings_finnish.txt	Diff File
	mod - lang/strings_greek.txt	Diff File
	mod - lang/strings_galician.txt	Diff File
	mod - lang/strings_tagalog.txt	Diff File
	mod - lang/strings_polish.txt	Diff File
	mod - lang/strings_norwegian_bokmal.txt	Diff File
	mod - lang/strings_estonian.txt	Diff File
master-1.2.x 8f23dcc4 2010-11-04 11:05 Damien Regad Committer: dhx Details Diff	Fix 0012167: Improve LDAP logging and comments in config_defaults.php Document the fact that LDAP port parameter is not used by ldap_connect when the provided hostname is a URI, and modify the logging in ldap_api.php to correctly reflect what is actually happening to avoid creating confusion. Implemented also additional improvements to LDAP logging, allowing to fully trace what is happening throughout the LDAP authentication process. Signed-off-by: David Hicks <d@hx.id.au>	Affected Issues 0012167
	mod - config_defaults_inc.php	Diff File
	mod - core/ldap_api.php	Diff File
master-1.2.x b3e7646f 2010-11-03 05:37 Damien Regad Committer: dhx Details Diff	Fix 0012166: LDAP log message changed Signed-off-by: David Hicks <d@hx.id.au>	Affected Issues 0012166
	mod - core/ldap_api.php	Diff File
master 98669e05 2010-11-03 05:37 Damien Regad Committer: dhx Details Diff	Fix 0012166: LDAP log message changed Signed-off-by: David Hicks <d@hx.id.au>	Affected Issues 0012166
	mod - core/ldap_api.php	Diff File
master 8b0fe3cd 2010-11-02 08:33 Damien Regad Committer: dhx Details Diff	Fix 0012504: Error in Edit User page when queried by LDAP username Use $t_user_id instead of $f_user_id variable, as the latter is not initialized when the user is identified by their username instead of id. Also removed useless assignment of $f_user_id, as the variable is not referenced anymore. Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0012504
	mod - manage_user_edit_page.php	Diff File
master-1.2.x 712ce667 2010-11-02 08:33 Damien Regad Committer: dhx Details Diff	Fix 0012504: Error in Edit User page when queried by LDAP username Use $t_user_id instead of $f_user_id variable, as the latter is not initialized when the user is identified by their username instead of id. Also removed useless assignment of $f_user_id, as the variable is not referenced anymore. Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0012504
	mod - manage_user_edit_page.php	Diff File
master-1.2.x 325c6a1d 2010-11-01 07:03 siebrand Details Diff	Fix 0009036: Message confirm_custom_field_unlinking has confusing text. Updated text to 'Are you sure you want to unlink this custom field from the project? The values will not be deleted as long as the custom field itself is not deleted.'	Affected Issues 0009036
	mod - lang/strings_english.txt	Diff File
master-1.2.x e1a519c1 2010-11-01 06:56 siebrand Details Diff	Fix 0010887: 'Remove User' button to remove user from project is confusing. Changed to read 'Remove User from Project <project name>'.	Affected Issues 0010887
	mod - manage_proj_user_remove.php	Diff File
	mod - lang/strings_english.txt	Diff File
	mod - manage_user_proj_delete.php	Diff File
master-1.2.x a256ece0 2010-11-01 06:38 siebrand Details Diff	* Replace   with HTML5 compliant &0000160; * Replace HTML incompliant breaks with <br />
	mod - bug_sponsorship_list_view_inc.php	Diff File
	mod - manage_proj_ver_edit_page.php	Diff File
	mod - proj_doc_edit_page.php	Diff File
	mod - plugins/MantisGraph/pages/config.php	Diff File
	mod - proj_doc_delete.php	Diff File
	mod - core/cfdefs/cfdef_standard.php	Diff File
	mod - manage_user_page.php	Diff File
	mod - manage_config_workflow_page.php	Diff File
	mod - core/custom_function_api.php	Diff File
	mod - admin/check.php	Diff File
	mod - account_sponsor_page.php	Diff File
	mod - admin/test_langs.php	Diff File
	mod - manage_tags_page.php	Diff File
	mod - view_all_inc.php	Diff File
	mod - print_all_bug_options_inc.php	Diff File
	mod - lost_pwd.php	Diff File
	mod - print_all_bug_page_word.php	Diff File
	mod - core/icon_api.php	Diff File
	mod - core/authentication_api.php	Diff File
	mod - print_bug_page.php	Diff File
	mod - lost_pwd_page.php	Diff File
	mod - manage_proj_delete.php	Diff File
	mod - tag_attach.php	Diff File
	mod - manage_custom_field_delete.php	Diff File
	mod - manage_overview_page.php	Diff File
	mod - my_view_inc.php	Diff File
	mod - manage_user_delete.php	Diff File
	mod - manage_proj_page.php	Diff File
	mod - manage_proj_user_remove.php	Diff File
	mod - tag_view_page.php	Diff File
	mod - signup_page.php	Diff File
	mod - bug_revision_view_page.php	Diff File
	mod - core/relationship_api.php	Diff File
	mod - manage_custom_field_edit_page.php	Diff File
	mod - tag_update_page.php	Diff File
	mod - manage_proj_edit_page.php	Diff File
	mod - login_page.php	Diff File
	mod - plugins/MantisGraph/core/Period.php	Diff File
	mod - core/collapse_api.php	Diff File
	mod - core/string_api.php	Diff File
	mod - adm_permissions_report.php	Diff File
	mod - bug_view_inc.php	Diff File
	mod - manage_proj_ver_delete.php	Diff File
	mod - core/filter_api.php	Diff File
	mod - admin/install.php	Diff File
	mod - manage_plugin_page.php	Diff File
	mod - view_filters_page.php	Diff File
	mod - plugins/MantisCoreFormatting/pages/config.php	Diff File
	mod - manage_config_email_page.php	Diff File
	mod - core/html_api.php	Diff File
	mod - manage_user_proj_delete.php	Diff File
	mod - query_view_page.php	Diff File
	mod - core/utility_api.php	Diff File
	mod - bug_update_advanced_page.php	Diff File
	mod - core/columns_api.php	Diff File
	mod - print_bugnote_inc.php	Diff File
	mod - manage_config_work_threshold_page.php	Diff File
	mod - signup.php	Diff File
	mod - manage_proj_custom_field_remove.php	Diff File
	mod - core/print_api.php	Diff File
	mod - proj_doc_page.php	Diff File
	mod - adm_config_report.php	Diff File
	mod - manage_proj_cat_edit_page.php	Diff File
master-1.2.x 0757e95c 2010-11-01 06:28 siebrand Details Diff	Fix 0012500: Missing localization in extended project browser.	Affected Issues 0012500
	mod - core/print_api.php	Diff File
master-1.2.x c85e1f5e 2010-10-28 19:33 siebrand Details Diff	Localisation updates from translatewiki.net.
	add - plugins/MantisCoreFormatting/lang/strings_belarusian_tarask.txt	Diff File
	mod - lang/strings_slovene.txt	Diff File
	mod - lang/strings_french.txt	Diff File
	add - lang/strings_interlingua.txt	Diff File
	mod - lang/strings_ukrainian.txt	Diff File
	add - lang/strings_belarusian_tarask.txt	Diff File
	mod - lang/strings_galician.txt	Diff File
	mod - config_defaults_inc.php	Diff File
	mod - lang/strings_ripoarisch.txt	Diff File
	mod - lang/strings_swissgerman.txt	Diff File
	mod - lang/strings_macedonian.txt	Diff File
	mod - lang/strings_dutch.txt	Diff File
master-1.2.x 59f24138 2010-10-26 12:00 daryn Details Diff	Fix Bug 0012174: Manage Columns not saving. The config_get calls in custom function was missing the second param for default value.	Affected Issues 0012174
	mod - core/custom_function_api.php	Diff File
master 5f82710f 2010-10-26 12:00 daryn Details Diff	Fix Bug 0012174: Manage Columns not saving. The config_get calls in custom function was missing the second param for default value.	Affected Issues 0012174
	mod - core/custom_function_api.php	Diff File
master ee1371d4 2010-10-22 08:17 Sergiodf Committer: dhx Details Diff	Fix 0012061: Status percentage bar should check for private bugs If the status percentage bar is enabled ($g_status_percentage_legend = ON), private bugs are counted even if the current user level is under $g_private_bug_threshold. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0012061
	mod - core/html_api.php	Diff File
master-1.2.x c783a403 2010-10-22 08:17 Sergiodf Committer: dhx Details Diff	Fix 0012061: Status percentage bar should check for private bugs If the status percentage bar is enabled ($g_status_percentage_legend = ON), private bugs are counted even if the current user level is under $g_private_bug_threshold. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0012061
	mod - core/html_api.php	Diff File
master-1.2.x 5f24068e 2010-10-22 07:19 dhx Details Diff	Issue 0011351: Fix variable names for $t_email Fixes commit 7672ca3d7f00 whereby some old variable names were not updated correctly. We're now using $t_email for comparisons instead of the direct user-supplied $f_email.	Affected Issues 0011351
	mod - manage_user_update.php	Diff File
master-1.2.x 7672ca3d 2010-10-22 06:59 dhx Details Diff	Fix 0011351: Real name and email should not be updated via GPC (LDAP) When LDAP is being used for retrieving the user real name and/or email address we should not provide any way for MantisBT forms to update these fields manually via GPC parameters to account_update and manage_user_update. Thus we don't need (and never wanted to) send hidden fields with forms containing the current LDAP details. A user could maliciously change these values by crafting their own HTTP POST queries to the server.	Affected Issues 0011351
	mod - manage_user_update.php	Diff File
	mod - account_page.php	Diff File
	mod - manage_user_edit_page.php	Diff File
	mod - account_update.php	Diff File
master 71ad8c6f 2010-10-22 06:59 dhx Details Diff	Fix 0011351: Real name and email should not be updated via GPC (LDAP) When LDAP is being used for retrieving the user real name and/or email address we should not provide any way for MantisBT forms to update these fields manually via GPC parameters to account_update and manage_user_update. Thus we don't need (and never wanted to) send hidden fields with forms containing the current LDAP details. A user could maliciously change these values by crafting their own HTTP POST queries to the server.	Affected Issues 0011351
	mod - manage_user_edit_page.php	Diff File
	mod - account_page.php	Diff File
	mod - account_update.php	Diff File
	mod - manage_user_update.php	Diff File
master c8961258 2010-10-22 06:24 dhx Details Diff	Fix 0012474: bug_report XSS issue when report_stay=1 The "report stay" feature of the bug report page allows the user to remain on the bug report page after submitting a report. After submission a new bug_report page is opened and is prefilled with data from the bug report just completed. The problem is that the hidden input fields are not properly escaped. This is not really a security issue as you need a valid one time CSRF token to access bug_report.php anyhow. It's more a case of users experiencing broken page output when they submit bug reports containing HTML characters (using the report stay feature).	Affected Issues 0012474
	mod - bug_report.php	Diff File
master-1.2.x da681451 2010-10-22 06:24 dhx Details Diff	Fix 0012474: bug_report XSS issue when report_stay=1 The "report stay" feature of the bug report page allows the user to remain on the bug report page after submitting a report. After submission a new bug_report page is opened and is prefilled with data from the bug report just completed. The problem is that the hidden input fields are not properly escaped. This is not really a security issue as you need a valid one time CSRF token to access bug_report.php anyhow. It's more a case of users experiencing broken page output when they submit bug reports containing HTML characters (using the report stay feature).	Affected Issues 0012474
	mod - bug_report.php	Diff File
master 1aa11780 2010-10-20 12:07 Damien Regad Committer: dhx Details Diff	Fix 0011351: Do not delete email or realname when editing user with LDAP When connecting to Mantis with LDAP and either use_ldap_email or use_ldap_realname = ON, that field is set to blank when the user edits their profile (account_page.php). The same happens when either or both of the above options are ON and the administrator updates a user from manage_user_edit_page.php. The original patch from Damien was updated to fix a few minor bugs and more importantly, to resolve a number of potential XSS vulnerabilities. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0011351
	mod - core/print_api.php	Diff File
	mod - account_page.php	Diff File
	mod - manage_user_edit_page.php	Diff File
master-1.2.x 99e7eedc 2010-10-20 12:07 Damien Regad Committer: dhx Details Diff	Fix 0011351: Do not delete email or realname when editing user with LDAP When connecting to Mantis with LDAP and either use_ldap_email or use_ldap_realname = ON, that field is set to blank when the user edits their profile (account_page.php). The same happens when either or both of the above options are ON and the administrator updates a user from manage_user_edit_page.php. The original patch from Damien was updated to fix a few minor bugs and more importantly, to resolve a number of potential XSS vulnerabilities. Co-contributed-by: David Hicks <hickseydr@optusnet.com.au> Signed-off-by: David Hicks <hickseydr@optusnet.com.au>	Affected Issues 0011351
	mod - manage_user_edit_page.php	Diff File
	mod - core/print_api.php	Diff File
	mod - account_page.php	Diff File
master-1.2.x 6172ca39 2010-10-19 15:36 atrol Details Diff	Fix 0012462: Wrong instruction order for new installations	Affected Issues 0012462
	mod - doc/INSTALL	Diff File

Changesets: MantisBT