MantisBT: master a4c4865b

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master 2020-11-22 07:54 master c6bf4f26
Affected Issues  0027361: Private category can be access/used by a non member of a private project (IDOR)
 0027826: ERROR_CATEGORY_NOT_FOUND_FOR_PROJECT thrown for Category '0'
Changeset

Prevent setting category not belonging to project

When retrieving a category for a given project, make sure that it is
available in the project's hierarchy, taking inheritance into account.

Fixes 0027361
mod - api/soap/mc_api.php Diff File