I can't reproduce this with the latest CVS HEAD (core/access_api.php v1.42, core/project_api.php 1.68, manage_proj_edit_page.php 1.86, manage_proj_page.php 1.16 ).

Can you provide more details?

Ok.
On a new installation with the last CVS HEAD (core/access_api.php v1.42, core/project_api.php 1.68, manage_proj_edit_page.php 1.86, manage_proj_page.php 1.17) :

I log as administrator.
I create a new user with reporter level.
I create a new private project.
I add the new user to the new project with reporter level.

=> new user still appear in the list of users I can had to the project
=> new user doesn't appear in the list of users added to the project.

In my new installation, config_inc.php contains only these parameters :

$g_hostname      = "localhost";
$g_db_username   = "root";
$g_db_password   = "";
$g_database_name = "mantisbt";
$g_administrator_email  = 'xx@xx.xxx';
$g_webmaster_email      = 'xx@xx.xxx';
$g_from_email           = 'xx@xx.xxx';
$g_return_path_email    = 'xx@xx.xxx';
$g_allow_file_upload    = ON;
$g_dhtml_filters = ON;

All of these have been updated recently. ( core/access_api.php v1.43, core/project_api.php 1.73, manage_proj_edit_page.php 1.86, manage_proj_page.php 1.18).

Can you retry this?

Issue do exists yet

I can no longer reproduce this here.

Could you provide the CVS versions of the core/access_api, core/project_api core/user_api and core/project_heirarchy_api that you are using?

access_api.php,v 1.43
project_api.php,v 1.73
user_api.php,v 1.99
project_hierarchy_api.php,v 1.6

I tested it on a new database, it seems no problem, but, in my old database, it do exist.

I have put my database file as attached, It's a password protected RAR file, you can send me a mail, then I will send you the password.

my mail: gy-zhang@uecsh.com

Fixed in CVS. Updated user_get_accessible_projects() to return all accessible projects regardless of heirarchy.

core/user_api.php -> 1.100