Access Denied when updating (status or assignment) a bug. (bug_update.php)

[schmoelle]

Hi,

I'm working with mantisbt 2.26.0 on a ubuntu 22.04 hosts.
Since upgrading from 20 to 22 I'm getting this error everytime when updating a bug.
Maybe because of php8.1?

Thats my config_inc.php:
<?php
$g_hostname = 'dbserver';
$g_db_type = 'mysqli';
$g_database_name = 'db-name';
$g_db_username = 'db-user';
$g_db_password = 'pw';
$g_allow_signup = ON; //allows the users to sign up for a new account

# --- Security ---
$g_crypto_master_salt = 'random'; # Random string of at least 16 chars, unique to the installation

# --- Anonymous Access / Signup ---
$g_allow_signup = ON;
$g_allow_anonymous_login = OFF;
$g_anonymous_account = '';

# --- Email Configuration ---
$g_phpMailer_method = PHPMAILER_METHOD_SMTP;
$g_smtp_host = 'smtp.domain.com';
$g_smtp_username = ''; # used with PHPMAILER_METHOD_SMTP
$g_smtp_password = ''; # used with PHPMAILER_METHOD_SMTP
$g_webmaster_email = 'noreply-mantisbt@domain.com';
$g_from_email = 'noreply-mantisbt@domain.com'; # the "From: " field in emails
$g_return_path_email = 'noreply-mantisbt@domain.com'; # the return address for bounced mail
$g_from_name = 'Mantis Bug Tracker';

# $g_email_receive_own = OFF;
# $g_email_send_using_cronjob = OFF;
$g_webmaster_email = 'mantis-admin@domain.com'; //this will be your administrator email address
$g_enable_email_notification = ON; //enables the email messages

# --- Attachments / File Uploads ---
# $g_allow_file_upload = ON;
# $g_file_upload_method = DATABASE; # or DISK
# $g_absolute_path_default_upload_folder = ''; # used with DISK, must contain trailing \ or /.
# $g_max_file_size = 5000000; # in bytes
# $g_preview_attachments_inline_max_size = 256 * 1024;
# $g_allowed_files = ''; # extensions comma separated, e.g. 'php,html,java,exe,pl'
# $g_disallowed_files = ''; # extensions comma separated

# --- Branding ---
# $g_window_title = 'MantisBT';
# $g_logo_image = 'images/mantis_logo.png';
# $g_favicon_image = 'images/favicon.ico';

# --- Real names ---
# $g_show_realname = OFF;
# $g_show_user_realname_threshold = NOBODY; # Set to access level (e.g. VIEWER, REPORTER, DEVELOPER, MANAGER, etc)

# --- Others ---
# $g_default_home_page = 'my_view_page.php'; # Set to name of page to go to after login

# --- logging ---
#$g_log_level = LOG_LDAP;
#$g_log_level = LOG_NONE;
$g_log_level = LOG_WEBSERVICE;
$g_log_destination = 'file:/var/log/mantis.log';

$g_show_detailed_errors = ON;

?>

Does anyone know what could be the problem?
Thanks in advance!

[atrol]

I am not able to reproduce.

Are there any installed plugins or custom functions ?
Was the MantisBT source code modified in any way ?

[schmoelle]

I am not able to reproduce.

Are there any installed plugins or custom functions ?
Was the MantisBT source code modified in any way ?

thanks for the quick response!
As far as I checked not custom functions are in place.
Attached are the installed plugins, for me it looks fine.

thanks in advance.

[atrol]

Attached are the installed plugins, for me it looks fine.

I don't see any attachment

[schmoelle]

Attached are the installed plugins, for me it looks fine.

I don't see any attachment

i'm getting an error: "Sorry, the board attachment quota has been reached."
Any idea? could also sent it to you via email or so.

Thanks!

[atrol]

Increased the quota, please try again to upload.

[schmoelle]

Increased the quota, please try again to upload.

thank you!
Attached you find the installed plugins:

[atrol]

Which access level is assigned to the affected user for the affected project?
What's the current status of the affected issue?
What are the settings for the affected project of "Status where an issue is considered resolved" / "Status where an issue becomes read only" / "Update an issue" / "Update readonly issues" / "Update issue status" / "Update readonly issues" / "Update issue status"
on page Manage > Configuration > Workflow Thresholds ?

[schmoelle]

Which access level is assigned to the affected user for the affected project?
What's the current status of the affected issue?
What are the settings for the affected project of "Status where an issue is considered resolved" / "Status where an issue becomes read only" / "Update an issue" / "Update readonly issues" / "Update issue status" / "Update readonly issues" / "Update issue status"
on page Manage > Configuration > Workflow Thresholds ?

I'm working with Administrator Role.
The status of the issue doesn't matter. Got the same problem with new created issues. When creating new one, I can directly assign but after that no update of the issue is possible where the bug_update.php get called.
We have the same issue with all projects, also with new created ones.
"Status where an issue is considered resolved - resolved
"Status where an issue becomes read only" - resolved
"Update an issue" - updater, developer, manager, administrator
"Update readonly issues" - manager, administrator
"Update issue status" - developer, manager, administrator

[atrol]

Did you check the web server / PHP logs for any errors and warnings?

[schmoelle]

Did you check the web server / PHP logs for any errors and warnings?

Sure checked everything but there wereno error.
So yesterday I decided to build up everything on docker and it worked.
As I wanted to change the settings on revproxy I had an issue with networks and switched back to the apache config.
For some reason, since I switched back everything is working

Would you recommend working with the apache config or docker (https://hub.docker.com/r/xlrl/mantisbt)?
Thank you for your help!

[atrol]

I have no experience in running a Docker based MantisBT for production purposes, so recommending / not recommending something would not be serious.