View Issue Details

IDProjectCategoryView StatusLast Update
0037019mantisbtuipublic2026-05-09 19:56
Reporterdregad Assigned Todregad  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Product Version2.11.0 
Target Version2.28.2Fixed in Version2.28.2 
Summary0037019: User's chosen font overwritten when saving preferences
Description

If the user's chosen font is no longer part of the list of available fonts, it gets silently changed to the first entry in the selection list when updating user preferences. This should not happen without a conscious user action.

TagsNo tags attached.

Relationships

related to 0037011 closeddregad CVE-2026-40596: XSS leading to account takeover via updating a user's font family preference 

Activities

There are no notes attached to this issue.

Related Changesets

MantisBT: master-2.28 16511e69

2026-04-11 15:48

dregad


Details Diff
New function helper_get_font_list()

Currently the retrieval of available fonts families is contained in
print_font_option_list() function. We need to be able to get it from
other parts of the code.

Issue 0037019
Affected Issues
0037019
mod - core/helper_api.php Diff File
mod - core/print_api.php Diff File

MantisBT: master-2.28 8fc74f44

2026-04-11 15:55

dregad


Details Diff
Don't overwrite stored font when updating user prefs

If the user's chosen font is no longer part of the list of available
fonts, we should not overwrite the value when updating user preferences
without a conscious user action.

Currently, the font is silently changed to the first entry in the
selection list.

Adding the current font to the selection list if it's not part of it
prevents this unwanted behavior.

Fixes 0037019
Affected Issues
0037019
mod - core/print_api.php Diff File