Search Changesets

MantisBT: master-1.2.x 628e9370

2012-06-02 00:35

dhx


Details Diff
Fix 0014015: attachment deletion: remove update_bug_threshold check

As reported by Roland Becker (MantisBT developer):

Although configuration option allow_delete_own_attachments is set to ON
reporters cannot delete their own attachments. After pushing the delete
button you get "Access Denied"

Issue 0014016 implemented correct attachment deletion access control
checks against delete_attachments_threshold. We should be using this
threshold instead of update_bug_threshold because attachments aren't
linked to the core fields of an issue -- they are frequently related to
comments (bugnotes) provided by less privileged users.

$g_allow_delete_own_attachments should now work again... safely.

Conflicts:
bug_file_delete.php
Affected Issues
0014015, 0014016
mod - api/soap/mc_issue_attachment_api.php Diff File
mod - bug_file_delete.php Diff File

MantisBT: master f82f98cc

2012-06-02 00:10

dhx


Details Diff
Fix 0014016: delete_attachments_threshold is not checked

Roland Becker (MantisBT developer) reported the following
security/access control bug:

In a default installation delete_attachments_threshold is set to
DEVELOPER but having access level >= update_bug_threshold is enough to
delete attachments if form_security_validation is set to OFF.

MantisBT was not checking the access level of the user requesting
deletion of an attachment to an issue against
$g_delete_attachments_threshold.

The new access control logic for deleting an issue attachment is now:
1. Does the user have an access level of at least update_bug_threshold?
2. If the user is the owner of the file and
$g_allow_delete_own_attachments=OFF, does this user have an access level
of at least delete_attachments_threshold?
3. If the user is not the owner of the file, do they have an access
level of at least delete_attachments_threshold?

Also refer to issue 0014015 for discussion on whether
update_bug_threshold should be part of the access control logic.

The relevant SOAP API call has also been updated.

Conflicts:
bug_file_delete.php
Affected Issues
0014015, 0014016
mod - api/soap/mc_issue_attachment_api.php Diff File
mod - bug_file_delete.php Diff File

MantisBT: master-1.2.x ceafe6f0

2012-06-02 00:10

dhx


Details Diff
Fix 0014016: delete_attachments_threshold is not checked

Roland Becker (MantisBT developer) reported the following
security/access control bug:

In a default installation delete_attachments_threshold is set to
DEVELOPER but having access level >= update_bug_threshold is enough to
delete attachments if form_security_validation is set to OFF.

MantisBT was not checking the access level of the user requesting
deletion of an attachment to an issue against
$g_delete_attachments_threshold.

The new access control logic for deleting an issue attachment is now:
1. Does the user have an access level of at least update_bug_threshold?
2. If the user is the owner of the file and
$g_allow_delete_own_attachments=OFF, does this user have an access level
of at least delete_attachments_threshold?
3. If the user is not the owner of the file, do they have an access
level of at least delete_attachments_threshold?

Also refer to issue 0014015 for discussion on whether
update_bug_threshold should be part of the access control logic.

The relevant SOAP API call has also been updated.
Affected Issues
0014015, 0014016
mod - api/soap/mc_issue_attachment_api.php Diff File
mod - bug_file_delete.php Diff File

MantisBT: master-1.2.x 804f6ed6

2012-06-01 22:46

dhx


Details Diff
Fix 0014342: mc_issue_api functions do not perform read only checks

Various SOAP functions in mc_issue_api.php did not perform checks to
ensure that read only issues are unmodifiable.
Affected Issues
0014342
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master 8208170b

2012-06-01 22:46

dhx


Details Diff
Fix 0014342: mc_issue_api functions do not perform read only checks

Various SOAP functions in mc_issue_api.php did not perform checks to
ensure that read only issues are unmodifiable.
Affected Issues
0014342
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master-1.2.x edc8142b

2012-06-01 20:40

dhx


Details Diff
Fix 0014340: Reporters can use SOAP to update bugnotes without permission

The access checks inside bugnote_update.php and
api/soap/mc_issue_api.php differed. Users were incorrectly allowed via
the SOAP interface to update the bugnotes of other users. Instead of
comparing the SOAP user's access level to $g_update_bugnote_threshold,
$g_add_bugnote_threshold was used instead.

This posed a problem because the default installed state of MantisBT is
to allow the REPORTER access level to submit bugs via the SOAP API. Thus
in the default installed state, any user who could submit a bug could
also update/modify the bugnotes of any other user.

Access checks within bugnote_update.php and api/soap/mc_issue_api.php
should now be equivalent.

Thanks to Roland Becker and Damien Regard (both MantisBT developers) for
finding and reporting this problem.
Affected Issues
0014340
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master 508cab00

2012-06-01 20:40

dhx


Details Diff
Fix 0014340: Reporters can use SOAP to update bugnotes without permission

The access checks inside bugnote_update.php and
api/soap/mc_issue_api.php differed. Users were incorrectly allowed via
the SOAP interface to update the bugnotes of other users. Instead of
comparing the SOAP user's access level to $g_update_bugnote_threshold,
$g_add_bugnote_threshold was used instead.

This posed a problem because the default installed state of MantisBT is
to allow the REPORTER access level to submit bugs via the SOAP API. Thus
in the default installed state, any user who could submit a bug could
also update/modify the bugnotes of any other user.

Access checks within bugnote_update.php and api/soap/mc_issue_api.php
should now be equivalent.

Thanks to Roland Becker and Damien Regard (both MantisBT developers) for
finding and reporting this problem.
Affected Issues
0014340
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master bbc8e9be

2012-06-01 19:34

dhx


Details Diff
Bug and bugnote access level checks should use project settings

Calls to config_get to retrieve configuration values should include the
relevant project ID to ensure that project-specific bugnote/bug
thresholds are taken into consideration over global settings.

An erronous use of the REPORTER constant has also been replaced. This
allows for valid/correct use of custom access levels in relation to the
$g_limit_reporters=ON functionality.
mod - core/access_api.php Diff File

MantisBT: master-1.2.x 8e5faf8c

2012-06-01 19:34

dhx


Details Diff
Bug and bugnote access level checks should use project settings

Calls to config_get to retrieve configuration values should include the
relevant project ID to ensure that project-specific bugnote/bug
thresholds are taken into consideration over global settings.

An erronous use of the REPORTER constant has also been replaced. This
allows for valid/correct use of custom access levels in relation to the
$g_limit_reporters=ON functionality.
mod - core/access_api.php Diff File

MantisBT: master-1.2.x 4c125ed8

2012-06-01 18:58

vboctor


Details Diff
Cleanup SOAP error handler which contained dead code.
mod - api/soap/mc_api.php Diff File

MantisBT: master ce7ec532

2012-06-01 18:58

vboctor


Details Diff
Cleanup SOAP error handler which contained dead code.
mod - api/soap/mc_api.php Diff File

MantisBT: master-1.2.x 01b4a042

2012-06-01 18:51

vboctor


Details Diff
Fixes 0014341: SOAP API is failing due to PHP errors that are ignored by the web app. Affected Issues
0014341
mod - api/soap/mc_api.php Diff File

MantisBT: master c2f15790

2012-06-01 18:51

vboctor


Details Diff
Fixes 0014341: SOAP API is failing due to PHP errors that are ignored by the web app. Affected Issues
0014341
mod - api/soap/mc_api.php Diff File

MantisBT: master-1.2.x 0faacc35

2012-06-01 18:44

vboctor


Details Diff
Fixes 0014094: mc_issue_add project['name'] is not used

Thanks to Tino Böhme (tino) for contributing a patch.
Affected Issues
0014094
mod - api/soap/mc_api.php Diff File

MantisBT: master c978645c

2012-06-01 18:44

vboctor


Details Diff
Fixes 0014094: mc_issue_add project['name'] is not used

Thanks to Tino Böhme (tino) for contributing a patch.
Affected Issues
0014094
mod - api/soap/mc_api.php Diff File

MantisBT: master-1.2.x ae8dbcb6

2012-06-01 09:47

jreese


Details Diff
Rename admin guide folder to fix docbook builds for release/nightlies
add - docbook/administration_guide/en/Makefile Diff File
add - docbook/administration_guide/en/about.sgml Diff File
add - docbook/administration_guide/en/administration_guide.sgml Diff File
add - docbook/administration_guide/en/authentication.sgml Diff File
add - docbook/administration_guide/en/configuration.sgml Diff File
add - docbook/administration_guide/en/contributing.sgml Diff File
add - docbook/administration_guide/en/customizing_mantis.sgml Diff File
add - docbook/administration_guide/en/file-entities.ent Diff File
add - docbook/administration_guide/en/installation.sgml Diff File
add - docbook/administration_guide/en/page_descriptions.sgml Diff File
add - docbook/administration_guide/en/project_management.sgml Diff File
add - docbook/administration_guide/en/troubleshooting.sgml Diff File
add - docbook/administration_guide/en/user_management.sgml Diff File
add - docbook/administration_guide/en/workflow.sgml Diff File
rm - docbook/adminguide/en/Makefile Diff
rm - docbook/adminguide/en/about.sgml Diff
rm - docbook/adminguide/en/administration_guide.sgml Diff
rm - docbook/adminguide/en/authentication.sgml Diff
rm - docbook/adminguide/en/configuration.sgml Diff
rm - docbook/adminguide/en/contributing.sgml Diff
rm - docbook/adminguide/en/customizing_mantis.sgml Diff
rm - docbook/adminguide/en/file-entities.ent Diff
rm - docbook/adminguide/en/installation.sgml Diff
rm - docbook/adminguide/en/page_descriptions.sgml Diff
rm - docbook/adminguide/en/project_management.sgml Diff
rm - docbook/adminguide/en/troubleshooting.sgml Diff
rm - docbook/adminguide/en/user_management.sgml Diff
rm - docbook/adminguide/en/workflow.sgml Diff

Tools: master faef9748

2012-06-01 08:42

jreese


Details Diff
Fix #14335: Ignore files in the docbook directory
mod - docbook-manual.py Diff File

MantisBT: master-2.0.x 3527cd65

2012-05-31 10:07

Paul Richards


Details Diff
Fix 0014333
mod - config_defaults_inc.php Diff File
mod - core/gpc_api.php Diff File
mod - core/http_api.php Diff File
mod - core/user_api.php Diff File

MantisBT: master f39ad8c9

2012-05-30 22:53

dregad


Details Diff
Make test for HTTPS protocol compliant with PHP documentation

Prior to this, the protocol was considered to be HTTPS when
isset($_SERVER['HTTPS']) is true, while PHP doc[1] states that HTTPS is
"Set to a non-empty value if the script was queried through the HTTPS
protocol" so the test should be !empty($_SERVER['HTTPS']) instead.

This was causing issues with nginx 1.x with php5fastcgi as
$_SERVER['HTTPS'] is set but empty, thus MantisBT redirects all http
requests to https.

The protocol check has been moved to a new function in http_api.php
which is then called wherever it is needed.

Note that there are several occurences of isset($_SERVER['HTTPS']) in
the nusoap library; these have not been modified.

Fixes 0014333

[1] http://php.net/manual/en/reserved.variables.server.php
Affected Issues
0014333
mod - config_defaults_inc.php Diff File
mod - core/gpc_api.php Diff File
mod - core/http_api.php Diff File
mod - core/user_api.php Diff File
mod - file_download.php Diff File

MantisBT: master-1.2.x 0af2d629

2012-05-30 22:53

dregad


Details Diff
Make test for HTTPS protocol compliant with PHP documentation

Prior to this, the protocol was considered to be HTTPS when
isset($_SERVER['HTTPS']) is true, while PHP doc[1] states that HTTPS is
"Set to a non-empty value if the script was queried through the HTTPS
protocol" so the test should be !empty($_SERVER['HTTPS']) instead.

This was causing issues with nginx 1.x with php5fastcgi as
$_SERVER['HTTPS'] is set but empty, thus MantisBT redirects all http
requests to https.

The protocol check has been moved to a new function in http_api.php
which is then called wherever it is needed.

Note that there are several occurences of isset($_SERVER['HTTPS']) in
the nusoap library; these have not been modified.

Fixes 0014333

[1] http://php.net/manual/en/reserved.variables.server.php
Affected Issues
0014333
mod - config_defaults_inc.php Diff File
mod - core/gpc_api.php Diff File
mod - core/http_api.php Diff File
mod - core/user_api.php Diff File
mod - file_download.php Diff File

MantisBT: master-2.0.x 94e36202

2012-05-30 12:06

Paul Richards


Details Diff
optimise filter api
mod - core/filter_api.php Diff File

MantisBT: master-2.0.x cfca3294

2012-05-30 12:04

Paul Richards


Details Diff
optimise config_can_delete
mod - core/config_api.php Diff File

MantisBT: master-2.0.x 94f42ec9

2012-05-30 12:04

Paul Richards


Details Diff
Optimise file_path_combine
mod - core/file_api.php Diff File

MantisBT: master 6dd51554

2012-05-30 03:40

Damien Regad


Details Diff
Update ADOdb to v5.17 (released 17-May-2012)

Changes vs upstream release[1]:

- removed following dirs and files:
contrib/ cute_icons_for_site/ docs/ pear/ tests/ server.php
- converted CRLF to LF
- trimmed trailing whitespace

[1] http://phplens.com/lens/lensforum/msgs.php?id=19169

Fixes 0013713
mod - library/README.libs Diff File
mod - library/adodb/adodb-active-record.inc.php Diff File
mod - library/adodb/adodb-active-recordx.inc.php Diff File
mod - library/adodb/adodb-csvlib.inc.php Diff File
mod - library/adodb/adodb-datadict.inc.php Diff File
mod - library/adodb/adodb-error.inc.php Diff File
mod - library/adodb/adodb-errorhandler.inc.php Diff File
mod - library/adodb/adodb-errorpear.inc.php Diff File
mod - library/adodb/adodb-exceptions.inc.php Diff File
mod - library/adodb/adodb-iterator.inc.php Diff File
mod - library/adodb/adodb-lib.inc.php Diff File
mod - library/adodb/adodb-memcache.lib.inc.php Diff File
mod - library/adodb/adodb-pager.inc.php Diff File
mod - library/adodb/adodb-pear.inc.php Diff File
mod - library/adodb/adodb-perf.inc.php Diff File
mod - library/adodb/adodb-php4.inc.php Diff File
mod - library/adodb/adodb-time.inc.php Diff File
mod - library/adodb/adodb-xmlschema.inc.php Diff File
mod - library/adodb/adodb-xmlschema03.inc.php Diff File
mod - library/adodb/adodb.inc.php Diff File
mod - library/adodb/datadict/datadict-access.inc.php Diff File
mod - library/adodb/datadict/datadict-db2.inc.php Diff File
mod - library/adodb/datadict/datadict-firebird.inc.php Diff File
mod - library/adodb/datadict/datadict-generic.inc.php Diff File
mod - library/adodb/datadict/datadict-ibase.inc.php Diff File
mod - library/adodb/datadict/datadict-informix.inc.php Diff File
mod - library/adodb/datadict/datadict-mssql.inc.php Diff File
mod - library/adodb/datadict/datadict-mssqlnative.inc.php Diff File
mod - library/adodb/datadict/datadict-mysql.inc.php Diff File
mod - library/adodb/datadict/datadict-oci8.inc.php Diff File
mod - library/adodb/datadict/datadict-postgres.inc.php Diff File
mod - library/adodb/datadict/datadict-sapdb.inc.php Diff File
mod - library/adodb/datadict/datadict-sqlite.inc.php Diff File
mod - library/adodb/datadict/datadict-sybase.inc.php Diff File
mod - library/adodb/drivers/adodb-access.inc.php Diff File
mod - library/adodb/drivers/adodb-ado.inc.php Diff File
mod - library/adodb/drivers/adodb-ado5.inc.php Diff File
mod - library/adodb/drivers/adodb-ado_access.inc.php Diff File
mod - library/adodb/drivers/adodb-ado_mssql.inc.php Diff File
mod - library/adodb/drivers/adodb-borland_ibase.inc.php Diff File
mod - library/adodb/drivers/adodb-csv.inc.php Diff File
mod - library/adodb/drivers/adodb-db2.inc.php Diff File
mod - library/adodb/drivers/adodb-db2oci.inc.php Diff File
mod - library/adodb/drivers/adodb-db2ora.inc.php Diff File
mod - library/adodb/drivers/adodb-fbsql.inc.php Diff File
mod - library/adodb/drivers/adodb-firebird.inc.php Diff File
mod - library/adodb/drivers/adodb-ibase.inc.php Diff File
mod - library/adodb/drivers/adodb-informix.inc.php Diff File
mod - library/adodb/drivers/adodb-informix72.inc.php Diff File
mod - library/adodb/drivers/adodb-ldap.inc.php Diff File
mod - library/adodb/drivers/adodb-mssql.inc.php Diff File
mod - library/adodb/drivers/adodb-mssql_n.inc.php Diff File
mod - library/adodb/drivers/adodb-mssqlnative.inc.php Diff File
mod - library/adodb/drivers/adodb-mssqlpo.inc.php Diff File
mod - library/adodb/drivers/adodb-mysql.inc.php Diff File
mod - library/adodb/drivers/adodb-mysqli.inc.php Diff File
mod - library/adodb/drivers/adodb-mysqlpo.inc.php Diff File
mod - library/adodb/drivers/adodb-mysqlt.inc.php Diff File
mod - library/adodb/drivers/adodb-netezza.inc.php Diff File
mod - library/adodb/drivers/adodb-oci8.inc.php Diff File
mod - library/adodb/drivers/adodb-oci805.inc.php Diff File
mod - library/adodb/drivers/adodb-oci8po.inc.php Diff File
mod - library/adodb/drivers/adodb-odbc.inc.php Diff File
mod - library/adodb/drivers/adodb-odbc_db2.inc.php Diff File
mod - library/adodb/drivers/adodb-odbc_mssql.inc.php Diff File
mod - library/adodb/drivers/adodb-odbc_oracle.inc.php Diff File
mod - library/adodb/drivers/adodb-odbtp.inc.php Diff File
mod - library/adodb/drivers/adodb-odbtp_unicode.inc.php Diff File
mod - library/adodb/drivers/adodb-oracle.inc.php Diff File
mod - library/adodb/drivers/adodb-pdo.inc.php Diff File
mod - library/adodb/drivers/adodb-pdo_mssql.inc.php Diff File
mod - library/adodb/drivers/adodb-pdo_mysql.inc.php Diff File
mod - library/adodb/drivers/adodb-pdo_oci.inc.php Diff File
mod - library/adodb/drivers/adodb-pdo_pgsql.inc.php Diff File
mod - library/adodb/drivers/adodb-pdo_sqlite.inc.php Diff File
mod - library/adodb/drivers/adodb-postgres.inc.php Diff File
mod - library/adodb/drivers/adodb-postgres64.inc.php Diff File
mod - library/adodb/drivers/adodb-postgres7.inc.php Diff File
mod - library/adodb/drivers/adodb-postgres8.inc.php Diff File
mod - library/adodb/drivers/adodb-proxy.inc.php Diff File
mod - library/adodb/drivers/adodb-sapdb.inc.php Diff File
mod - library/adodb/drivers/adodb-sqlanywhere.inc.php Diff File
mod - library/adodb/drivers/adodb-sqlite.inc.php Diff File
add - library/adodb/drivers/adodb-sqlite3.inc.php Diff File
mod - library/adodb/drivers/adodb-sqlitepo.inc.php Diff File
mod - library/adodb/drivers/adodb-sybase.inc.php Diff File
mod - library/adodb/drivers/adodb-sybase_ase.inc.php Diff File
mod - library/adodb/drivers/adodb-vfp.inc.php Diff File
mod - library/adodb/lang/adodb-esperanto.inc.php Diff File
mod - library/adodb/lang/adodb-it.inc.php Diff File
mod - library/adodb/lang/adodb-pt-br.inc.php Diff File
mod - library/adodb/license.txt Diff File
mod - library/adodb/perf/perf-db2.inc.php Diff File
mod - library/adodb/perf/perf-informix.inc.php Diff File
mod - library/adodb/perf/perf-mssql.inc.php Diff File
mod - library/adodb/perf/perf-mssqlnative.inc.php Diff File
mod - library/adodb/perf/perf-mysql.inc.php Diff File
mod - library/adodb/perf/perf-oci8.inc.php Diff File
mod - library/adodb/perf/perf-postgres.inc.php Diff File
mod - library/adodb/pivottable.inc.php Diff File
mod - library/adodb/readme.txt Diff File
mod - library/adodb/rsfilter.inc.php Diff File
mod - library/adodb/session/adodb-compress-bzip2.php Diff File
mod - library/adodb/session/adodb-compress-gzip.php Diff File
mod - library/adodb/session/adodb-cryptsession.php Diff File
mod - library/adodb/session/adodb-cryptsession2.php Diff File
mod - library/adodb/session/adodb-encrypt-mcrypt.php Diff File
mod - library/adodb/session/adodb-encrypt-md5.php Diff File
mod - library/adodb/session/adodb-encrypt-secret.php Diff File
mod - library/adodb/session/adodb-encrypt-sha1.php Diff File
mod - library/adodb/session/adodb-session-clob.php Diff File
mod - library/adodb/session/adodb-session-clob2.php Diff File
mod - library/adodb/session/adodb-session.php Diff File
mod - library/adodb/session/adodb-session2.php Diff File
mod - library/adodb/session/crypt.inc.php Diff File
mod - library/adodb/session/old/adodb-cryptsession.php Diff File
mod - library/adodb/session/old/adodb-session-clob.php Diff File
mod - library/adodb/session/old/adodb-session.php Diff File
mod - library/adodb/session/session_schema.xml Diff File
mod - library/adodb/session/session_schema2.xml Diff File
mod - library/adodb/toexport.inc.php Diff File
mod - library/adodb/tohtml.inc.php Diff File
mod - library/adodb/xmlschema.dtd Diff File
mod - library/adodb/xsl/convert-0.1-0.2.xsl Diff File
mod - library/adodb/xsl/convert-0.1-0.3.xsl Diff File
mod - library/adodb/xsl/convert-0.2-0.1.xsl Diff File
mod - library/adodb/xsl/convert-0.2-0.3.xsl Diff File
mod - library/adodb/xsl/remove-0.2.xsl Diff File
mod - library/adodb/xsl/remove-0.3.xsl Diff File

MantisBT: master-2.0.x 64fc65c0

2012-05-29 12:09

Paul Richards


Details Diff
rename static variable
mod - core.php Diff File
 First  Prev  1 2 3 ... 70 ... 140 ... 210 ... 280 ... 344 345 346 347 348 349 350 ... 420 ... 490 ... 560 ... 630 ... 700 ... 743 744 745  Next  Last