View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0036509mantisbtcode cleanuppublic2025-10-19 05:032026-02-07 03:03
Reporterdregad Assigned Tovboctor  
PrioritynormalSeverityminorReproducibilityalways
Status resolvedResolutionfixed 
Product Version2.26.0 
Target Version2.29.0Fixed in Version2.29.0 
Summary0036509: Account Update does not use UserUpdateCommand
Description

When UserUpdateCommand was implemented in 0032464, account_update.php was not adapted to use the new command.

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
related to 0032464 closedvboctor Implement UserUpdateCommand 
related to 0036005 closeddregad CVE-2025-55155: Lack of verification when changing a user's email address 

Activities

vboctor

vboctor

2026-02-05 23:19

manager   ~0070766

PR: https://github.com/mantisbt/mantisbt/pull/2179

Related Changesets

MantisBT: master 2f9f8bbc

2026-02-05 23:16

vboctor


Details Diff		 Update `account_update.php` to use `UserUpdateCommand`

Fixes 0036509		 Affected Issues
0036509
mod - account_update.php Diff File

MantisBT: master f6c92d91

2026-02-06 15:38

vboctor


Details Diff		 Add tests for allow_blank_email

Tests that the `allow_blank_email` config is respected when clearing
a user's email via the REST API: admin is always allowed, non-admin
is rejected when `OFF` and allowed when `ON`.

Fixes 0036509		 Affected Issues
0036509
mod - tests/rest/RestUserTest.php Diff File

MantisBT: master b7d37e2a

2026-02-06 22:46

vboctor


Details Diff		 Use ?? operator in UserUpdateCommand

Fixes 0036509		 Affected Issues
0036509
mod - core/commands/UserUpdateCommand.php Diff File