View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0037133mantisbtuipublic2026-05-15 11:072026-06-03 11:19
Reporterraspopov Assigned Tocommunity  
PrioritynormalSeverityminorReproducibilityalways
Status resolvedResolutionfixed 
Product Version2.28.3 
Target Version2.29.0Fixed in Version2.29.0 
Summary0037133: The buttons on the “Access Denied” widget may contain incorrect links
Description

For example, the “/admin/login_page.php?return=admin%2Findex.php” is converted to “admin/login_page.php?return=admin%2Findex.php” for "Login" button.

Steps To Reproduce

The following conditions must be met:

  • MantisBT must be located in the root directory of the site, i.e., $g_short_path = '/'.
  • The page displaying the “Access Denied” widget must be located in a subdirectory, such as “/admin/”, and require administrator privileges.
  • The user must not be logged in.
  • Anonymous user logins must be enabled ($g_allow_anonymous_login = ON) so that the “Access Denied” widget is displayed when an access error occurs, rather than a redirect.
Additional Information

This happens because the root “/” is stripped from relative URLs in the string_sanitize_url() function, which prepares the links for the widget buttons.
In our case, when the following line is executed:

        return ( !empty( $t_script_path ) ? $t_script_path . '/' : '' ) . $t_script . $t_query . $t_anchor;

the variables $t_script_path and $t_script now contain empty strings, and the root “/” is not restored.

TagsNo tags attached.

Relationships

Relationship GraphDependency Graph
related to 0037235 resolveddregad Open Redirect with return parameter in login_page.php 

Activities

raspopov

raspopov

2026-05-15 11:14

reporter   ~0071115

PR: https://github.com/mantisbt/mantisbt/pull/2222
raspopov

raspopov

2026-05-15 11:19

reporter   ~0071116

For example, the “/admin/login_page.php?return=admin%2Findex.php” is converted to “admin/login_page.php?return=admin%2Findex.php” for "Login" button.

Oops, I meant that the link for the button should be “/login_page.php?return=admin%2Findex.php”, but because the “/” is missing, it turns into “login_page.php?return=admin%2Findex.php” and since the button is on the “/admin/” page, the full path becomes “/admin/login_page.php?return=admin%2Findex.php”.
dregad

dregad

2026-05-16 13:08

developer   ~0071120

Nice catch, thanks @raspopov.

MantisBT must be located in the root directory of the site, i.e., $g_short_path = '/'.

Just checking - are you actually setting $g_short_path (because normally you should not), or just stating that it holds / as set by core.php ?
raspopov

raspopov

2026-05-16 13:29

reporter   ~0071121

By core.php, automatically.
raspopov

raspopov

2026-05-18 12:04

reporter   ~0071134

I decided to write comprehensive tests for all execution paths within the string_sanitize_url() function and address all the “FIXME” markers. Surprisingly, the tests failed....

The patch I proposed fixes one bug but introduces another, albeit a less serious one. When calling the function with the absolute path flag (which wasn’t checked in the tests), the “/” is duplicated — for example, the link “https://localhost/css/default.css” becomes “https://localhost//css/default.css”.

I am proposing a new patch to restore the string changed in the previous patch, which also fixes the missing “/” error using a different method. It also resolves the issue of the '$g_short_path' string not being searched for thoroughly enough in the processed path. The new code also removes the double “/” characters where the $g_path, $g_short path, and query strings are merged.

https://github.com/mantisbt/mantisbt/pull/2224

Related Changesets

MantisBT: master ad1be12b

2026-05-17 04:51

raspopov

Committer: community


Details Diff		 Fix the string_sanitize_url() lost slash

Fixed an issue where the “/” was missing when rebuilding URLs
during sanitization.

Fixes 0037133, PR https://github.com/mantisbt/mantisbt/pull/2222		 Affected Issues
0037133
mod - core/string_api.php Diff File
mod - tests/Mantis/StringTest.php Diff File

MantisBT: master 2006074b

2026-05-24 15:15

raspopov

Committer: community


Details Diff		 Fix the string_sanitize_url() lost slash again

Added comprehensive tests.

Fixes 0037133, PR https://github.com/mantisbt/mantisbt/pull/2224		 Affected Issues
0037133
mod - core/string_api.php Diff File
mod - tests/Mantis/StringTest.php Diff File