0037460: Adding a note to a read-only issue is denied when "All Projects" is selected, although allowed by the project's threshold

ID	Project	Category	View Status	Date Submitted	Last Update
0037460	mantisbt	authentication	public	2026-10-25 11:22	2026-10-26 05:12

Reporter	c_schmitz	Assigned To	community
Priority	normal	Severity	minor	Reproducibility	always
Status	assigned	Resolution	open
Product Version	2.28.4
Target Version	2.29.0

Summary	0037460: Adding a note to a read-only issue is denied when "All Projects" is selected, although allowed by the project's threshold
Description	bug_is_readonly() reads $g_bug_readonly_status_threshold for the issue's project, but $g_update_readonly_bug_threshold for the user's currently selected project. When update_readonly_bug_threshold is overridden at project level, the result therefore depends on the project selector. view.php overrides the current project, so the "Add Note" form is shown, but when the note is submitted, bugnote_add.php -> IssueNoteAddCommand::validate() -> bug_is_readonly() evaluates the threshold for "All Projects" and rejects the note: APPLICATION ERROR #1103: The action cannot be performed because issue "X" is read-only. (HTTP 403) If the user selects the issue's project first, the note is added.
Steps To Reproduce	Steps to reproduce: As administrator, in Manage > Configuration > Workflow Thresholds for All Projects, keep "Update read-only issues" (update_readonly_bug_threshold) at MANAGER. For project A only, set "Update read-only issues" to REPORTER. Create a user with DEVELOPER access to project A. In project A, create an issue and close it. Log in as the developer and select "All Projects" in the project selector. Open the closed issue, enter a note and submit it. Actual result: APPLICATION ERROR #1103 ... issue is read-only (HTTP 403) Expected result: The note is added, as it is when project A is selected.
Additional Information	PR: https://github.com/mantisbt/mantisbt/pull/2297
Tags	No tags attached.

View Issue Details

Activities