View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0034854mantisbtadministrationpublic2024-10-17 08:162025-03-01 18:40
Reporteratrol Assigned Toatrol  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version2.26.4 
Target Version2.27.1Fixed in Version2.27.1 
Summary0034854: Error when creating global profiles
Description

Get "Access Denied" when trying to create a new global profile.

Regression intrododuced in 2.26.4 when fixing 0034640

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
related to 0034640 closeddregad CVE-2024-45792: Insecure Direct Object References vulnerability with user profiles 
related to 0034824 resolveddregad Multiple execution of the same query with Profile API functions 

Activities

atrol

atrol

2024-10-17 08:21

developer   ~0069359

PR https://github.com/mantisbt/mantisbt/pull/2040
atrol

atrol

2024-10-17 08:23

developer   ~0069360

@dregad looks like this is fixed in 2.28.0 as a side effect of your refactoring.
dregad

dregad

2024-10-17 09:08

developer   ~0069361

looks like this is fixed in 2.28.0 as a side effect of your refactoring.

Yes it's quite possible. Do you want me to test and confirm ?

I think it's better to apply the quick fix to 2.27.1 to fix the regression anyway, instead of backporting the refactor.
atrol

atrol

2024-10-18 16:38

developer   ~0069365

Yes it's quite possible. Do you want me to test and confirm ?

Not needed, I tested and found it's fixed.

I think it's better to apply the quick fix to 2.27.1 to fix the regression anyway, instead of backporting the refactor.

Agree, that's why I created the PR.

Related Changesets

MantisBT: master-2.27 9d313412

2024-10-17 08:12

atrol


Details Diff		 Fix error when creating a global profile

Fixes 0034854		 Affected Issues
0034854
mod - account_prof_update.php Diff File