MantisBT 2.26.2 Released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

MantisBT 2.26.2

Security and maintenance release addressing several vulnerabilities (CVE-2024-34077, CVE-2024-34080 and CVE-2024-34081; refer to the corresponding Issues below for details).

It also resolves a few PHP 8.x compatibility issues, as well as a few other bugs.

All installations are strongly advised to upgrade as soon as possible.

  •  0033906: [bugtracker] Failed opening core.php in timeline_inc.php on PHP 8.2 / IIS (dregad)
  •  0034008: [documentation] MantisGraph: document usage of EVENT_MANTISGRAPH_SUBMENU (dregad)
  •  0034006: [code cleanup] MantisGraph: fix deprecated warnings in javascript (dregad)
  •  0034393: [html] Incorrect handling of HTML hexadecimal character references &#xNNN; (dregad)
  •  0034439: [code cleanup] Deprecated warning when updating Issue with null checkbox Custom Field (dregad)
  •  0034441: [excel] Excel error when opening exported issues with custom field with special characters (dregad)
  •  0034435: [bugtracker] Issue note links don’t reflect if issue is resolved (vboctor)
  •  0034434: [security] CVE-2024-34080: Don’t hyperlink references to notes whose issues are not accessible to user (vboctor)
  •  0034433: [security] CVE-2024-34077: Account Takeover in Password Reset and Account Registration Feature (dregad)
  •  0034432: [security] CVE-2024-34081: Unsanitised custom field names printed (dregad)
  •  0034417: [security] Update corejs-typeahead.js library to 1.3.4 (dregad)
  •  0034410: [api rest] REST API error reports incorrect field “version” when updating fixed in / target version with invalid value (dregad)
  •  0034399: [other] Internal server error on view_user_page (atrol)
  •  0012956: [bugtracker] Target Version does not respect GET or POST value when reporting issue (dregad)
  •  0034404: [bugtracker] Proceed button is shown twice when redirecting with pending errors (dregad)
  •  0034359: [api rest] REST API: “String not found” warning when adding note with invalid view_state (dregad)
  •  0034348: [api rest] Adding issue note with REST API returns HTTP 500 when given view_state is invalid (dregad)
  •  0034018: [filters] Filter “assigned to” and “monitor by” shows <br /> between the users when selecting multiple (advanced filtering) (dregad)
  •  0034106: [code cleanup] Deprecated creation of dynamic properties in BugData class (dregad)

MantisBT 2.26.1 Released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

MantisBT 2.26.1

Security and maintenance release addressing a host header injection vulnerability (CVE-2024-23830).

It also resolves several regression issues introduced in 2.26.0 release, and includes fixes for PHP 8.x compatibility as well as other issues.

All installations are strongly advised to upgrade as soon as possible.

  •  0033171: [db schema] Update ADOdb to 5.22.7 (dregad)
  •  0033481: [ui] Missing space between “*” and label for required fields on bug report page (dregad)
  •  0033426: [authentication] User not authenticated when following link from notification email (dregad)
  •  0033422: [api rest] Updating an issue with bugnote having empty text causes PHP errors (dregad)
  •  0033418: [documentation] Document PHP ctype extension as required (dregad)
  •  0033402: [api rest] Updating an Issue through the API sets all comments last edit timestamp (community)
  •  0033374: [other] Erratic behavior of RestProjectVersionTest::testProjectUpdateVersion PHPUnit test case (dregad)
  •  0033372: [db mssql] SQL error opening Manage Users page with MSSQL (dregad)
  •  0033248: [custom fields] APPLICATION ERROR 2800 Invalid form security token when trying to delete custom field (dregad)
  •  0033358: [custom fields] Custom fields are showing when resolving issues form despite not checking the option (atrol)
  •  0033375: [tools] Enable PHP 8.3 on Travis CI builds (dregad)
  •  0033404: [authorization] Unable to grant user access to private issue by adding them as a monitoring user (atrol)
  •  0033480: [bugtracker] Blank page when redirecting with print_successful_redirect() (dregad)
  •  0019381: [security] CVE-2024-23830: Host header attack vulnerability (dregad)
  •  0033519: [installation] MySQL Native Driver (mysqlnd) is required (dregad)
  •  0033588: [administration] Creating an Configuration Option with complex array fails when number is negative (dregad)
  •  0033631: [code cleanup] Uncaught exception in installer (dregad)
  •  0033634: [rss] Error in creating RSS when there are no issues to publish (dregad)
  •  0033651: [ui] Overflowing text issue on sidebar menu (dregad)
  •  0033756: [installation] Errors on browser console when installing (dregad)
  •  0033773: [installation] Install: reset buttons for table prefix/suffix not working at stage 2 (dregad)

MantisBT 2.26.0 Released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

MantisBT 2.26.0

This long-overdue feature and maintenance release contains nearly 150 fixes and enhancements !

Among many other things, it finally brings support for PHP 8.2, and generally improves PHP 8 compatibility. The earliest supported PHP version is now 7.2.5.

There are also numerous improvements to the REST API.

New configuration options were added to control access to Export and Print Report features (see 0022224). The default value for the latter was set to UPDATER for security reasons (see 0025492); to restore earlier behavior, administrators should set $g_print_reports_threshold = VIEWER;.

It would be somewhat pointless to copy the whole list of fixed issues here; please refer to the Change Log for complete details.

MantisBT 2.25.8 released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

All installations are strongly advised to upgrade as soon as possible.

MantisBT 2.25.8

Security and maintenance release addressing an information disclosure issue (CVE-2023-44394) and a security issue in bundled GuzzleHttp library (CVE-2023-29197). This release also resolves several PHP 8.x compatibility and REST API issues.

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

  •  0028618: [bugtracker] Category empty but required does not prevent form submission on Firefox Windows and Safari (dregad)
  •  0029438: [api rest] Unsupported operand types when an incident with time tracking notes is updated via REST API (dregad)
  •  0032390: [plug-ins] Impossible to install a plugin without any dependencies (dregad)
  •  0032432: [security] Update guzzlehttp/psr7 to 1.9.1 (dregad)
  •  0032612: [bugtracker] DEPRECATED: ‘Creation of dynamic property BugData::$bug_text_id (dregad)
  •  0032451: [bugtracker] Email uniqueness is not enforced on case-sensitive databases (dregad)
  •  0032459: [bugtracker] Graphics x Apple Safari 16 (atrol)
  •  0032703: [bugtracker] Local documentation is not accessible (403) (dregad)
  •  0032788: [ui] Incorrect styling of table headers (dregad)
  •  0032809: [bugtracker] PHP 8.1 deprecation notice in user_search_cache() (dregad)
  •  0032860: [api rest] REST API allows resolving an issue with unresolved children (dregad)
  •  0032865: [html] Wrong HTML tags on “Manage Filters” page (atrol)
  •  0032889: [plug-ins] EVENT_MENU_DOCS is never triggered (dregad)
  •  0026365: [api rest] Missing Authorization header in REST API causing requests to fail (dregad)
  •  0032981: [security] CVE-2023-44394: Information Leakage on DokuWiki Integration (dregad)

MantisBT 2.25.7 released

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

In order to stay up to date with the latest MantisBT news, please star our GitHub repository, join our Gitter channel, or follow us on X and retweet to spread the word!

Go ahead and download the release from our website.

MantisBT 2.25.7

Hotfix release, correcting a regression on PHP 8.1 introduced in 2.25.6, and addressing a few other issues.

All installations are strongly advised to upgrade as soon as possible.

  •  0030127: [email] new PHPMailer() is created for every outgoing email (dregad)
  •  0032076: [bugtracker] Ampersand in $g_search_title prevents adding search engine (dregad)
  •  0032086: [bugtracker] IssueViewPageCommand.php line 135: ‘Undefined array key “version” with php 8.1.16 (dregad)
  •  0032243: [plug-ins] EVENT_LOG can produce stack overflow when LOG_DATABASE is enabled (dregad)
  •  0032131: [performance] access_project_array_filter can lead to many SQL requests (dregad)
  •  0032353: [bugtracker] Getting Undefined index: target_version when viewing bug (atrol)