View Issue Details

IDProjectCategoryView StatusLast Update
0037320mantisbtbugtrackerpublic2026-07-21 18:33
Reportersyzop Assigned Tocommunity  
PrioritynormalSeveritymajorReproducibilityalways
Status resolvedResolutionfixed 
Product Version2.28.4 
Target Version2.29.0Fixed in Version2.29.0 
Summary0037320: Cannot submit bug when selecting any product version
Description

Since mantisBT 2.28.4, when trying to submit a bug, when a user selects ANY Product Version mantis will reject the bug saying invalid version. I already missed several bug reports due to this.

Oh and this issue is also present on this/your very bugtracker. I just had to retype my whole bug report because of it :-)

If you have like DEVELOPER level then the bug does not occur. If you select NO product version then the bug does not occur.

The fix in "Additional Information" or a workaround is setting: $g_report_issues_for_unreleased_versions_threshold = REPORTER;

Thanks for fixing this. We are happy to use mantis since 2002 :)

Additional Information

The fix is changing core/commands/IssueAddCommand.php

From:

if( $t_version_id != 0 ) {
        if( !access_has_project_level( config_get( 'report_issues_for_unreleased_versions_threshold' ) ) ) {
                throw new ClientException(
                        'User not allowed to assign unreleased versions',
                        ERROR_INVALID_FIELD_VALUE,
                        ['version']
                );
        }
        $this->issue->version = version_get_field( $t_version_id, 'version' );
}

To something like:

if( $t_version_id != 0 ) {
        if( !version_is_released( $t_version_id ) && !access_has_project_level( config_get( 'report_issues_for_unreleased_versions_threshold' ) ) ) {
                throw new ClientException(
                        'User not allowed to assign unreleased versions',
                        ERROR_INVALID_FIELD_VALUE,
                        ['version']
                );
        }
        $this->issue->version = version_get_field( $t_version_id, 'version' );
}

EDIT (dregad): add markdown for proper code indentation

Tagspatch

Relationships

related to 0037065 closedcommunity CVE-2026-52882: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters 

Activities

dregad

dregad

2026-07-21 12:41

developer   ~0071320

Thanks for the report and proposed fix @syzop, sorry about the inconvenience.

Are you saying the problem was introduced in 2.28.4 (i.e. not present in 2.28.3) ? If so, then it's likely a regression introduced by MantisBT master-2.28 0ac87c39 (see 0037065). I cannot analyze right now, will check later on.

Would you be able/willing to submit a pull request with the proposed patch ?

We are happy to use mantis since 2002 :)

Wow, early customer :-) thanks for your continued trust !

syzop

syzop

2026-07-21 12:53

reporter   ~0071321

Yes exactly, the bug was introduced in 2.28.4, when the code that checks for report_issues_for_unreleased_versions_threshold was added. I'll do a PR.

And yeah we're an old project/user: https://bugs.unrealircd.org/view.php?id=8 (date submitted.. 2001-12-28 19:39) :-)

syzop

syzop

2026-07-21 13:08

reporter   ~0071322

Done, created as https://github.com/mantisbt/mantisbt/pull/2251

dregad

dregad

2026-07-21 18:25

developer   ~0071323

I confirm the regression, and that your patch fixes it. Many thanks !

Related Changesets

MantisBT: master 4cfa980d

2026-07-21 18:33

syzop

Committer: community


Details Diff
Fix unable to submit issue when a released version is selected

Previous fix 0037065 in 2.28.4 [1] added a version check but this
has a regression: it causes us to refuse a bug report if any
product version is selected by a reporter.

Fixes 0037320, PR https://github.com/mantisbt/mantisbt/pull/2251

[1]: commit 0ac87c39fb4746a2f8c276730fa689baf47ba8ba
Affected Issues
0037065, 0037320
mod - core/commands/IssueAddCommand.php Diff File