File mantisbt.changes of Package mantisbt

Overview Repositories Revisions Requests Users Attributes Meta

File mantisbt.changes of Package mantisbt (Revision 62e918531261cb3a214ad5d6b29a2b69)

Currently displaying revision 62e918531261cb3a214ad5d6b29a2b69 , Show latest

-------------------------------------------------------------------
Tue Aug 11 09:11:56 UTC 2020 - Andreas Stieger <andreas.stieger@gmx.de>

- MantisBT 2.24.2:
  * CVE-2020-16266: HTML injection (maybe XSS) via custom field on
    view_all_bug_page.php
  * update PHPMailer from 6.1.4 to 6.1.6
- MantisBT 2.24.1:
  * security
    - APIs expose private attachments to users who has access to
      issue but not private notes
    - file_get_visible_attachments shows private files that should
      be invisible to the user
  * various bug fixes and improvements

-------------------------------------------------------------------
Thu Apr 23 14:02:02 UTC 2020 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- MantisBT 2.24.0
  * administration
    - how can I allow user to view only the issue that assigned to them #0010831
  * api rest
    - Passing invalid id to rest api custom field update causes program crash #0026541
    - Passing out of range custom field id causes multiple PHP warnings / 
      incorrect response #0026542
    - Passing unsanitized data to type hinted function causes program crash #0026540
    - Support user password reset via REST API #0026632
    - Update GuzzleHttp from 6.4.1 to 6.5.2 #0026441
  * authentication
    - login username is not trimmed #0025097
  * bugtracker
    - Allow multiple, customizable due date levels #0026438
    - Change of due date background color #0016869
    - Implement limit_reporters as a threshold #0023570
    - Inheritance of sub project not read correctly from database #0026765
    - Make category on bug_report_page a required field when 
      $g_allow_no_category = OFF; #0026686
    - Mass update does not allow setting an empty category #0026690
    - Reporter can't see an issue they have been made a monitor of #0015466
    - Required fields when reporting an issue, should also be when updating it #0026687
  * code cleanup
    - Code Cleanup #0026567
    - Remove $g_log_destination 'firebug' option, as the project is dead 
      since 2017 #0026572
  * customization
    - Retire bug_change_status_page_fields config option #0026778
  * db mssql
    - Update ADOdb to 5.20.16 #0026598
  * documentation
    - Admin Guide: remove doc for long-deprecated $g_ldap_port config #0026589
  * email
    - Update phpmailer/phpmailer from 6.1.3 to 6.1.4 #0026475
  * feature
    - Limit reporter's access to their own issues #0009534
  * filters
    - BugFilterQuery - issue? - trying to add join & where conditions #0024600
    - Wrong filtering by none-relationship #0026621
  * installation
    - Add informational comments to SQL script generated by installer #0026661
    - Allow admin to reset table pre/suffix to their default values #0026664
    - Apostrophe in custom_field_string table causes upgrade from < 1.2.0 
      to fail #0026636
    - Final statement to set database version not logged in SQL script #0026662
    - improve installer messages when generating SQL script #0026663
    - Use appropriate statement to update DB schema when generating SQL 
      #0026568
  * localization
    - lang_get_defaulted does not search for fallback language #0021201
  * plug-ins
    - Improve MantisColumn sort capability to allow sorting by more complex 
      expressions #0026612
    - New Event: EVENT_MENU_ISSUE_RELATIONSHIP #0011365
    - No equivalent to lang_get_defaulted() in plugin_api() #0026747
  * relationships
    - Dependency Graph crash on circular parent child relationships #0011381
    - Relationship Graph - inconsistency between button label and title #0026165
    - Relationship Graph page is missing legend #0026164
    - Relationship Graph page UI lacks MantisBT 2.x layout #0026163
  * reports
    - Display issue Summary inside relation graph nodes #0017594
    - Wrong number of displayed rows on summary page #0026555
  * roadmap
    - User can't see in roadmap a private issue that they reported #0025115
  * rss
    - Access of non existent image in RSS feeds #0021133
  * time tracking
    - Cell coloring for due date indicates "overdue" when not overdue yet.  #0009155
  * ui
    - Generate token with empty name and APPLICATION ERROR #11 #0026623
    - Incorrect CSS rules get applied if a word in custom field name 
      matches an existing CSS class #0026473
    - Issue list throws warning on every issue without bug notes. #0026439
    - on mantisbt.org Roadmap progress bar 'data-percent' class could stand 
      out better #0022142
    - Provide a way to 'show content' for all complex items on Manage 
      Configuration Report page #0026712

-------------------------------------------------------------------
Wed Jan  8 08:53:24 UTC 2020 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- Move admin files to /usr/share/php[57] to have them available for system updates
- A POST script has been added which copies the admin files, executes them 
  and removes the files after a successfull update
- Cleaned up the spec

-------------------------------------------------------------------
Fri Dec 13 07:53:08 UTC 2019 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- MantisBT 2.23.0:
  * administration
    - Custom fields selector in manage project page are not ordered by name 
      #0026368
    - Use empty value as default project in "manage project" subproject 
      section #0026367
  * api rest
    - Error requesting issues using saved filter #0026195
    - Implement IssueViewPageCommand to separate logic from rendering of 
      issue view page #0025902
    - Update GuzzleHttp from 6.3.3 to 6.4.1 #0026374
    - Update Slim Framework to 3.12.3 #0026086
  * attachments
    - Add files information to EVENT_BUGNOTE_ADD event #0025960
    - Attaching files to a note creates a second note with only the 
      attachments #0024113
    - Attachments should be linkable to notes in db #0021733
    - Comments on attachments #0009363
    - Create a place holder note when submitting attachments without text 
      #0026082
    - Deleting a note, should delete associated attachments #0024577
    - "private bugnotes" as default setting prevents uploading further 
      attachments #0022817
    - Support attachments associated with private notes #0009802
    - Support inline playing of audio attachments #0026095
    - Support inline playing of video attachments #0026102
    - Switching note to private/public, should impact associated 
      attachments #0026081
    - Warning for users when making public notes with attachments private 
      #0025935
  * auditing
    - Link attachments issue history events to attachments to determine 
      visibility #0026083
  * bugtracker
    - Closing issues via group action with empty note creates a bugnote 
      record #0026150
    - PHP notice in bug view page when viewing issue without category 
      #0026094
    - Tags are not copied from master issue when cloning #0026326
  * custom fields
    - Filter value "none" is not available for multiselection list custom 
      fields #0026030
    - Manage custom fields page does not show fields in order #0025975
    - Use custom field regular expression in the html input #0025972
    - Use max length property of custom field in inputs #0026141
  * db postgresql
    - check_pgsql_bool_columns: check wrongly suggests that the 
      redirect_delay should be in boolean format #0026109
  * documentation
    - Invalid URL for GraphViz home page #0026092
    - preview_*_extensions config options not documented #0026096
    - Update ERD diagram to reflect new field in bug_file table #0026098
    - Wrong data types in ERD #0021799
  * email
    - Bump phpmailer/phpmailer from 6.0.7 to 6.1.3 #0026265
    - "Email on monitoring" not configurable in manage_config_email_page 
      #0026002
  * feature
    - Allow setting reminder bugnotes' view status #0010107
  * filters
    - Filter for a date custom field fails when no values for this field 
      exists #0026062
    - No way to filter "negative" for checkbox custom fields #0021712
  * javascript
    - Update corejs-typeahead.js library to 1.3.0 #0026382
  * performance
    - Issue view api uses many custom field database queries #0026166
    - Issue view history api repeated calls to bug_get_attachments database 
      query #0026167
  * plug-ins
    - Content Security Policy directive 'frame-ancestors' contains an 
      invalid source when http_csp_add is called for it #0026093
  * reports
    - Move MantisGraph pages to their own tab #0026139
  * security
    - Update ADOdb to 5.20.15 #0026388
    - Vulnerability from library Moment.js 2.15.2 #0026358
  * tagging
    - Add $g_tag_create_threshold to Workflow Thresholds in the GUI #0026119
    - Tag attachments list includes tags already attached to the bug 
      #0026353
  * time tracking
    - Application Error 401 when clicking Time Tracking at the bottom of a 
      bug notes page #0026132
    - Bugnotes time spent info is always shown even if time tracking is 
      disabled #0026134
  * ui
    - Attachments displayed with empty user #0026128
    - Attachments without note text are not displayed #0026294
    - Both "monitor" and "end monitoring" buttons are displayed #0026123
    - Clone button is not displayed correctly #0026295
    - Inline actions user experience is inconsistent between different 
      features #0025905
    - "Users monitoring this issue" section not shown if nobody is 
      monitoring the issue #0026125

-------------------------------------------------------------------
Tue Dec 10 08:38:37 UTC 2019 - Andreas Stieger <andreas.stieger@gmx.de>

- MantisBT 2.22.2:
  * fix bug: Field "EXCEL columns" has space or tabulation

-------------------------------------------------------------------
Sun Sep 29 06:33:58 UTC 2019 - Andreas Stieger <andreas.stieger@gmx.de>

- MantisBT 2.22.1:
  * CVE-2019-15715: Command Execution / Injection Vulnerability
  * CVE-2019-8331: bundled Bootstrap updated to 3.4.1
  * Enable integrity hashes for CSS ressources from CDNs
  * Show content for Complex Configuration option did not work when
    mod_rewrite is disabled

-------------------------------------------------------------------
Fri Aug 30 13:17:55 UTC 2019 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- MantisBT 2.22.0
  * administration
    - Impossible to set add/remove monitors thresholds from manage page #0025826
    - Simplify displaying of complex values in adm_config_report page #0025910
  * api rest
    - Adding issue via REST API should fail if requested tags can't be 
      attached #0026076
    - Invalid JSON response when creating issue with tag by name via REST 
      API #0025997
    - IssueAddCommand should create tag specified by name if they do not 
      exist #0026077
    - Missing tag name in error message when creating issue via REST API 
      #0025996
    - REST API support for multiple authorization headers #0025362
  * api soap
    - SOAP API return value does not match definition in WSDL #0025470
  * attachments
    - Add support for pasting images as attachments #0021797
  * bugtracker
    - Ability to add monitors to a bug when the bug is first reported #0006128
    - error_string() does not allow HTML tags inside of error messages #0025749
    - IssueAddCommand does not create history entries identical to the code 
      it replaced #0025962
    - PHP Notices in User API #0025850
    - Replace mailto: by link to user profile page in view.php #0025686
    - Status color squares become black #0024189
    - Users can't add monitors if access < show_monitor_list_threshold and 
      >= monitor_add_others_bug_threshold #0025815
  * code cleanup
    - Glue after String Array is being Deprecated #0026063
    - MantisGraph: define Chart.js-related constants in the plugin #0025952
    - New prepare_mailto_url() API function #0025849
    - Remove get_email_link() API function #0025848
    - Remove unused $p_can_report_only parameter in 
      layout_navbar_projects_list() #0025894
  * documentation
    - Admin guide: remove reference to unmaintained Firefox add-on #0025904
    - Improve documentation for monitors-related configs #0025827
  * html
    - Invalid HTML in manage_config_workflow_page.php #0025784
    - Leading newlines disappear when editing data in textarea elements #0025839
  * installation
    - Reflect PHP requirements in Composer config #0025774
  * javascript
    - Improve client-side sortable tables script #0025911
  * other
    - bug_report_page is forced to be cached #0025969
  * plug-ins
    - Add EVENT_MENU_MAIN_FILTER to allow complete customisation of main 
      menu #0024590
    - EVENT_BUGNOTE_DATA event not documented in developer manual #0025914
    - Gravatar Plugin Description #0026066
    - Improve plugin schema upgrade error message #0025162
    - MantisGraph: update Chart.js library to v2.8.0 #0025951
    - Missing an API function to check if a plugin event has been declared #0025953
  * printing
    - Remove hyperlinks on usernames in Word export #0025851
  * security
    - Email for a new private bugnote was send to a non authorized reporter #0022898
    - CVE-2019-15539: Stored XSS on Project Documentation
  * tagging
    - Creating an invalid tag should fail with an error #0026074
    - Report issue doesn't support multiple new tags #0024441
    - Tag-related error messages should reference the tag's name #0026075
  * time tracking
    - Time tracking box rendering is broken #0023725
  * tools
    - PHPUnit tests as run by Travis CI builds do not execute all defined 
      suites #0025961
  * ui
    - Gravatar plugin should always use https #0025963

-------------------------------------------------------------------
Thu Jun 27 07:45:46 UTC 2019 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- MantisBT 2.21.1
  * administration
    - Button label truncated on manage_config_workflow_page #0025783
    - LOGFILE_NOT_WRITABLE error triggered if file does not exist #0025734
    - Wrong access_level settings when updating rights in the project admin 
      page #0025722
  * attachments
    - File upload timeout #0025763
  * other
    - Summary "By Date (days)" gets wrong number #0025742
  * reports
    - Summary statistics db error message #0025781

-------------------------------------------------------------------
Wed May 22 07:27:20 UTC 2019 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- MantisBT 2.21
  * administration
    - E_USER_DEPRECATED errors are no longer displayed inline #0025629
    - If log file is not writable, log_event() fails silently #0019642
    - PHP Notice or incorrect file+line number when displaying DEPRECATED 
      error #0025631
  * api rest
    - Inconsistent naming of username field in REST API #0025688
    - Update Slim Framework to 3.12.1 #0025703
  * bugtracker
    - Redirect to the new issue's page after reporting it #0025695
  * customization
    - Modification to status colors css #0023550
  * documentation
    - Encoding of custom files not documented #0022143
    - Upgrade guide does not mention plugins #0022972
  * filters
    - sub-project assignments missing from project-specific My View page 
      #0023333
  * installation
    - Missing file (api/rest/web.config) in installer #0025614
  * ldap
    - LDAP documentation - Remove invalid 'hostname:port' example #0025664
  * performance
    - Improve performance of Summary Page queries #0025693
    - Update color when new Status is selected in Bug Update Page #0025651
  * plug-ins
    - View Issue page menu links from EVENT MENU_ISSUE event are
      wrapped with "[", "-" characters #0023694
  * timeline
    - My View page without timeline does not respect the 
      $g_my_view_boxes_fixed_position setting #0022096
  * ui
    - Focus on project search #0023037
    - My View Page layout misses some boxes #0022104
    - Plugin tab in Summary section not highlighted when selected #0023418
    - Projects menu search box should be hidden when having a small number 
      of projects #0025594
    - Show Invite button for users with manage users access level, not just 
      administrators #0025682
    - Show status with a color square instead of background color on Bug 
      Update Page #0025650
    - Uneven distribution of boxes on My View page when Timeline is OFF 
      #0025679

-------------------------------------------------------------------
Mon Mar 18 10:36:27 UTC 2019 - Johannes Weberhofer <jweberhofer@weberhofer.at>

- MantisBT 2.20

* administration
    - Cant modify configuration for All projects if only one project exists 
      #0020054
    - "Check Installation" is missing from Admin menu #0025130
    - inconvenience while handling user's accounts #0005151
    - Manage project, copy from/to forms are easy to click accidentally and 
      don't ask for confirmation #0025368
  * api rest
    - Allow adding/updating/deleting subprojects via REST API #0025400
    - /api/rest/issues endpoint supposedly returns all issues, but doesn't 
      #0025102
    - Get project doesn't return all versions #0025381
    - Simple and Advanced filters are not consistent for handling 
      sub-project issues #0025515
    - Undefined variable t_show_detailed_errors in API REST #0025429
    - Update Slim Framework to 3.12.0 #0025437
  * attachments
    - Dropzone max-filesize option is not correct #0025463
    - Dropzone preview does not work #0025465
    - Enforce max-filesize in dropzone to alert and drop big files before 
      form submission #0025464
    - Redesign Dropzone file previews #0025572
  * authentication
    - Token error when login with a newly created user #0025110
  * code cleanup
    - default_email_on_status, misleading comments in config_defaults 
      #0020069
    - Take care of released/obsolete flag when accessing 
      version_cache_array_rows() cache #0022100
    - Wrong caching in version API #0024821
  * db mssql
    - Wrong/duplicate bugnote_text_id in mantis_bugnote_table #0025442
  * documentation
    - $g_notify_new_user_created_threshold_min is ignored on new account 
      creation #0025403
    - Manual does not describe variable "g_from_name" #0017304
    - Minor documentation fixes #0025408
  * email
    - Bump phpmailer/phpmailer from 6.0.6 to 6.0.7 #0025436
    - check all/ uncheck all checkbox for email notifcation #0025434
  * excel
    - Float custom field saved as String in XML-Excel export #0025174
  * feature
    - Add filtered summary #0004624
    - Usability suggestion at Report Issue screen #0023045
  * filters
    - Cannot filter by versions of parent project when child project 
      selected #0012261
    - Improve presentation of temporary filters #0024775
    - Permalink - Filter lose information after click on view issues 
      #0024549
    - Switching simple/advanced for a temporary filter loses the filter 
      #0024776
  * html
    - Filter widget does not hide botton bar when collapsed #0025109
  * performance
    - Massive queries to user table in edit project #0023904
    - project versions are not cached efficiently #0023245
  * plug-ins
    - MantisGraph: improve display of By Category Bar chart #0025524
    - MantisGraph: improve handling of colors in Pie charts #0025523
    - MantisGraph: limit number of slices in By Category pie chart #0025522
  * relationships
    - Error when adding a relationship if bug id contains whitespace as 
      prefix or suffix #0025532
    - When adding multiple relationships, ignore source issue and empty 
      issue ids #0025533
  * reports
    - Filter by dates in Summary Graphs #0014656
    - Filtered Summary #0021931
    - MantisGraph, implement filtered summary for graphs #0025164
    - MantisGraph. Reporter graph does not fit width of page #0025168
    - MantisGraph summary links don't hghlight current graph page #0025163
    - Missing pie chart in "By Category Graphs" #0022099
    - Script error in graphs #0025210
    - Summary doesn't honour issue access #0025165
    - SYSTEM NOTICE on graph pages #0025466
    - Update Chart.js to 2.7.3 #0025488
    - View Issues - Select a Filter - Graph are not linked on this choice 
      #0009757
  * rss
    - RSS feeds broken when using PHP >= 7.0 #0025213
  * security
    - Fix Bootstrap security issues (CVE-2018-14040, CVE-2018-14041, 
      CVE-2018-14042) #0024672
    - web.config file is missing in api/rest #0024347
  * sql
    - Page adm_config_report has queries missing db_param_push() #0025456
  * tools
    - Travis CI builds fail for PHP 7.3 #0025390
  * ui
    - Enable selection of a range in checkboxes lists. #0025217
    - Incorrect spacing between submenu and main div for some MantisGraph 
      screens #0025386
    - MantisGraph: redundant subtitle on Issue Trends page #0025387
    - Page adm_config_report does not cache users and generate many 
      database queries #0025454
    - Page adm_config_report, users in filter list are not correctly 
      ordered #0025455
    - Project selection is shown even if the user has no accesible projects 
      #0025133
    - Provide sortable functionality to simple tables #0025378
    - 'show_queries_count' is a global setting, but 'show_memory_usage', 
      'show_timer' are not #0025446
    - Summary page submenu not aligned when screen narrower than buttons 
      #0025385

-------------------------------------------------------------------
Fri Jan 11 10:03:50 UTC 2019 - jweberhofer@weberhofer.at

- MantisBT 2.19
  https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.19.0

* Updates: ADOdb, Guzzle, Slim Framework, PHPMailer, 
    Disposable Email Checker 
  * Fixed installation issue (memory_limit test fails when memory_limit 
    is set to -1, PHP 7.3 issue)
  * Fixed authentication issues
  * Improved form handling for password managers
  * Fixed some UI issues
  * Code cleanup

- Updated file lists, removed additional files not used in distribution

-------------------------------------------------------------------
Thu Nov 29 12:08:59 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.18
  * Code Cleanup
  * Plugin Columns - Export CSV or Excel - PHP 7.2.7 - crash error 500
  * Changes to project_view_state and view_state to create only private projects
  * Missing fallback for "Open Sans" font
  * Error Creating Issue with new TAG
  * Performance enhancements of string processing

- MantisBT 2.17.2
  * CVE-2018-17783: XSS in manage_filter_edit_page.php
  * CVE-2018-17782: XSS in manage_filter_page.php

-------------------------------------------------------------------
Mon Oct  1 09:46:19 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.17.1
  CVE-2018-16514: Reflected XSS in view_filters_page.php via core/filter_form_api.php

- MantisBT 2.17.0
  https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.17.0
  This is a selection of improvements among many others:
  * better visibility of relationships
  * search for users in the administration
  * REST and SOAP API improvements

-------------------------------------------------------------------
Fri Sep 14 07:14:29 UTC 2018 - astieger@suse.com

- MantisBT 2.16.1:
  * CVE-2018-14895: XSS in bug_actiongroup.php

-------------------------------------------------------------------
Mon Aug  6 05:58:35 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.16.0
  https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.16.0
  * ui
    - Local copy of Open Sans font does not include Latin-ext characters 
    - Fonts are not rendered correctly in Windows clients
    - Font = Times News Roman after Upgrade from v2.7.0
  * upgrade
    - Improve handling of unserialize errors when upgrading
    - Error in upgrade process 1.2.17 --> 1.3.0
  * performance
    - Unneeded information in Change Log and Roadmap
    - Performance enhancement of config_get_global function
  * timeline
    - Missing display of events in Timeline if All Projects is selected
  * code cleanup

-------------------------------------------------------------------
Thu Jun 28 10:22:27 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.15.0
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=321
  * filters
    - Cannot save private filter if not allowed to save shared filter
    - show_user_realname_threshold is not considered when sorting by reporter or handler
  * bugtracker: Incorrect issue status setting when changing status
  * wiki: URL encoding precludes reasonable wiki root_namespace values
  * tagging: Exception Missing Class
  * security: Update-Blocker:User-ID instead of Realname 0024139 as due 
    to security policy requirements which prohibit IDs in mails and masks
  * ui
    - Selecting users is not easy if show_realname is set to ON
    - $g_show_realname for making usernames private
  * other: System warning if $g_log_destination = 'page' when using PHP 7.2
  * api soap: Error while querying for issue header with PHP 7.2
  * api rest: Support create project versions via REST API
  * performance: Unneeded &lt;meta&gt; tag in &lt;head&gt; section

- Removed unused adodb scripts

- Don't package several test-cases from sub-packages as well 
  as vendor/phpunit. As the mantisbt test-cases are not in the upstream package
  we don't run any checks.

-------------------------------------------------------------------
Tue May 15 08:40:23 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.14.0
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=316
  * IssueAddCommand Prevents API Folder Removal
  * Update ADOdb to 5.20.12
  * E_DEPRECATED error on php7.2: each() function
  * Update Slim Framework from 3.8.1 to 3.9.2
  * Update GuzzleHttp from 6.3.0 to 6.3.2
  * Wrong documentation of datetime_picker_format in Admin Guide
  * Wrong documentation of my_view_boxes in Admin Guide
  * Support getting a single project via REST API
  * Plugin priority changed without being changed by user interaction

- MantisBT 2.13.2
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=319
  * CVE-2018-9839: Private issues accessible to unauthorized users using 
    the "Clone" functionality
  * Markdown quoting rendered with broken HTML
  * email: Inconsistent realname display
  * REST API:
    - Get all filter or specific filter returns incorrect information
    - REST API returns too much info for default category handler
    - Don't show category default handler for users that can't manage the project
  * api soap: API method mc_filter_get does not work
  * mb_internal_encoding no longer being set because of removal utf8 library
  * SYSTEM WARNING 'count(): Parameter must be an array or an object that 
    implements Countable' in 'IssueNoteAddCommand.php

-------------------------------------------------------------------
Thu Apr  5 15:33:42 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.13.1
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=317
  * Fixed broken rendering of @ mentions, # issue and ~ note links

- MantisBT 2.13.0
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=315
  * Filter improvements
  * Support adding attachments when reporting issues
  * Several REST and SOAP API improvements
  * Can't login if admin directory has restricted access
  * Filtering with "note by" shows results from private notes for unprivileged users
  * Entering Emojis in comments with a user mention crashes with an error (mysql)

- MantisBT 2.12.1
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=314
  * Account page required change password on any field modification
  * Username (Realnames) format not showing on timeline (my_view_page)
  * Wrong color of username in timeline
  * History entries display realname instead of username

- MantisBT 2.12.0
  https://www.mantisbt.org/bugs/changelog_page.php?version_id=312
  * Improvements to menioning users with @user
  * Language updates
  * User realname uniqueness check doesn't work

-------------------------------------------------------------------
Wed Feb 14 07:29:40 UTC 2018 - jweberhofer@weberhofer.at

- MantisBT 2.11.1
  * https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.11.1
  * Bugfix: REST API doesn't work from UI for some users
  * Bugfix: Warning message on login page after new installation

-------------------------------------------------------------------
Fri Feb  9 10:24:13 UTC 2018 - jweberhofer@weberhofer.at

- Removed vendor/adodb/adodb-php/server.php file which isn't required
  but leads into CVE-2018-6382 and bsc#1078308
- Require fileinfo extension

- MantisBT 2.11.0
  * https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.11.0
  * Administration: 
    - Allow unprotecting protected users
    - Other fixes
  * REST API: 
    - Added handling of tags, users, relationships, monitoring,
      attachements, time-tracking
  * Reports:
    - Several improvements
  * Installation fixes
  * Further improvements and code-cleanups

-------------------------------------------------------------------
Thu Feb  8 11:29:22 UTC 2018 - astieger@suse.com

- MantisBT 2.10.1, a bugfix and security release:
  * unable to create a bug with customfields via SOAP
  * Wrong constructor name in class FilterConverter
  * Resolving as duplicate does not add reporter and handler to
    monitoring list of duplicate issue
  * CVE-2018-6403: XSS in adm_config_report.php 'value' parameter

-------------------------------------------------------------------
Tue Jan 30 07:04:11 UTC 2018 - jweberhofer@weberhofer.at

- Update to 2.10.0
  * https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.10.0
  * REST API: Filter improvements
  * Fixes in time-tracking
  * Further fixes and refactorings

-------------------------------------------------------------------
Tue Dec 19 21:06:26 UTC 2017 - jweberhofer@weberhofer.at

- Update to 2.9.0
  * https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.9.0
  * fixes and refactorings
  * REST API ipmrovements

-------------------------------------------------------------------
Fri Nov  3 17:38:03 UTC 2017 - jweberhofer@weberhofer.at

- update to 2.8.0
  * https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.8.0
  * fixes
  * REST API: updates, on by default
  * DKIM support for E-Mail signing

- REST API requires php-soap
- MatisBT requires php 5.5.0+

-------------------------------------------------------------------
Sat Oct 14 19:09:50 UTC 2017 - astieger@suse.com

- update to 2.7.0:
  * ui rendering fixes
  * performance improvements
  * fixes related to custom fields and filters

-------------------------------------------------------------------
Tue Sep 19 11:22:40 UTC 2017 - jweberhofer@weberhofer.at

- MantisBT 2.6.0

REST API
  * projects doesn't return child projects (vboctor)
  * Notes returned by /issues REST API have incorrect timestamps (vboctor)
  * Support adding/deleting notes via REST API (vboctor)
  * Support issue id as part of the path for REST API (vboctor)

Attachments
  * Can't open image attachments in browser windows (dregad)

Bugtracker
  * AJAX calls with invalid endpoints fail with syntax error (dregad)
  * bug_actiongroup_page, on copy, & move, poject combo lists projects wich the user has no rights (cproensa)
  * Update GuzzleHttp from 6.2.3 to 6.3.0 (vboctor)

* Sutomization
  * Custom fields badly filtered when multi-projects (cproensa)
  * Field is appearing in email notification but not used in UI. (joel)

E-Mail
Update disposable-email-checker to v3.0.1 using Composer (vboctor)
  * Update PHPMailer v5.2.23 to v5.2.24 (vboctor)
  * Removing "Report an issue" permission removes user from Monitoring filter dropdown (atrol)
  * Due date field not displayed correctly when editing ticket (community)
  * Unused code and unused CSS delivered for obsoleted functionality (atrol)
  * Unused CSS delivered (atrol)

Markdown
  * Update Parsedown 1.6.2 to 1.6.3 (vboctor)

Performance
  * Project cache is not efficient with navbar project selection. (cproensa)
  * Unused and inefficient code in function layout_print_sidebar (atrol)

Time Tracking
  * Enabling Time Tracking distorts View Issue Details page layout. (cproensa)
  * Issue history box is narrower than other boxes above it on View Issue page (cproensa)
  * Time Tracking "auto count" is giving the wrong elapsed time (dregad)
  * Time tracking report excludes issues with no category assigned (cproensa)
  * Unable to access time tracking reports (atrol)

UI
  * 'Manage Configuration' tab usually does not highlight (dregad)
  * "notify user" check should be moved outside the form (cproensa)
  * Calendar doesn't show the correct date the first time it opens (dregad)
  * Display of hardcoded string on view_user_page if e-mail address is empty (atrol)
  * Graph display is too faint and blurred (atrol)
  * print_manage_menu() does not highlight active plugin pages (dregad)
  * Questionable display of "Access Denied" on view_user_page (atrol)
  * Questionable order and functionality of top buttons on "View Issue" page (atrol)
  * The required fields are not explicitly visible when updating, resolving or closing an issue (community)
  * When specifiying top_buttons display, the button on update screen has no styling. (atrol)

-------------------------------------------------------------------
Mon Sep  4 15:08:03 UTC 2017 - astieger@suse.com

- MantisBT 2.5.2:
  * Login page no longer warns about 'admin' directory being present
  * Checks on login page are never executed if "admin" dir does not exist
  * Improve doc and notifications when admin dir is present (CVE-2017-12419) 
  * drop patches:
    CVE-2017-12061.patch CVE-2017-12062.patch
- make mantis a versioned provides capability

-------------------------------------------------------------------
Tue Aug  1 22:46:27 UTC 2017 - astieger@suse.com

- Fix two XSS vulnerabilities:
  * CVE-2017-12061: XSS in /admin/install.php script (bsc#1051697)
    add CVE-2017-12061.patch
  * CVE-2017-12062: XSS in manage_user_page.php (bsc#1051698)
    add CVE-2017-12062.patch

-------------------------------------------------------------------
Tue Aug  1 22:36:15 UTC 2017 - astieger@suse.com

- MantisBT 2.5.1:
  * REST API improvements, SOAP API fixes

-------------------------------------------------------------------
Mon May 22 20:43:26 UTC 2017 - astieger@suse.com

- MantisBT 2.4.1:
  * Support Generic Authentication through Plug-ins
  * various fixes and improvements

-------------------------------------------------------------------
Mon Apr 17 08:05:04 UTC 2017 - astieger@suse.com

- MantisBT 2.2.4:
  * CVE-2017-7615: Account verification page allows resetting any
    user's password (bsc#1034333)
- includes changes from 2.2.3:
  * Sorting all bugs list using a column header after applying a
    filter resets the filter
  * Permalink does not work with "Note By"
  * Filter error due to "view status" having an array value
  * Regression in custom field sorting
  * CVE-2017-7309: XSS in adm_config_report.php (bsc#1031807)
  * CVE-2017-7241: XSS in move_attachments_page.php (bsc#1031807)
  * Markdown starts heading in the middle of a line
  * Markdown still converting '& amp;' to & and '& lt;' to <
- includes changes from 2.2.2:
  * CVE-2017-6973: XSS in adm_config_report.php (bsc#1031807)

-------------------------------------------------------------------
Mon Mar 20 19:47:58 UTC 2017 - astieger@suse.com

- MantisBT 2.2.1:
  * various improvements and bug fixes
  * fix XSS in Source Integration Plugin (CVE-2017-6958)
  * fix XSS in bug change status page (CVE-2017-6797)
  * fix XSS in view filters pages (CVE-2017-6799)

-------------------------------------------------------------------
Thu Jan 19 15:07:06 UTC 2017 - branislav.havel@suse.com

- MantisBT 2.0.0
- package moved to mantisbt
  * System utilities page for moving attachments should support move 
    all attachments
  * Replace jscalendar by a newer widget
  * Incorrect text for the remove file button in the file upload dropzone
  * Section 2.2.2.1 Admin Guide: Misaligned row in Table
  * Missing leading zeroes in due date display
  * datetime picker does not work if 'cdn_enabled' is ON
  * Due Date calendar icon wraps below the field

-------------------------------------------------------------------
Thu Jan  5 14:37:21 UTC 2017 - astieger@suse.com

- MantisBS 1.3.5:
  * security fix: Potentially serious RCE vulnerability in bundled
    PHPMailer before 5.2.18 (CVE-2016-10033)
  * performance improvements, bugfixes, UI fixes and improvements
- MantisBS 1.3.4:
  * security fix: Handlers(Assignees) are visible when editing an
    issue even if they are not visible when viewing it
  * performance improvements, bugfixes, UI fixes and improvements

-------------------------------------------------------------------
Mon Oct 31 07:32:49 UTC 2016 - astieger@suse.com

- MantisBT 1.3.3, a bugfix release:
  * various fixes for bugs in the UI, behavior and code
  * documentation updates

-------------------------------------------------------------------
Sun Oct 30 09:55:01 UTC 2016 - astieger@suse.com

- MantisBt 1.3.2, a bugfix update:
  * documentation updates
  * Various bug fixes and compatible feature updates
  * Fix Invalid Strict-Transport-Security header when server would
    already send it anyway

-------------------------------------------------------------------
Thu Sep  1 00:28:49 UTC 2016 - astieger@suse.com

- MantisBt 1.3.1, a security and bugfix update
  * CVE-2016-7111: Content Security Policy is weakened by Gravatar plugin
  * CVE-2016-6837: XSS vulnerability in view_all_bug_page.php
  * various bug fixes

-------------------------------------------------------------------
Tue Jul 12 16:59:23 UTC 2016 - astieger@suse.com

- MantisBT 1.3.0, a security and feature update
- New features:
  * @ mentions support
  * Support for avatar plugins - shipping Gravatar out of the 
  * Support for user lifecycle plugin events
  * Allow administrators to impersonate users
  * Support for notes and tags as columns to configure for view
    issues, print issues, csv/excel export
  * Support for login using email address
  * Enforcing email uniqueness
  * Enable configuration for email notifications for category owner
  * Re-implemented parsing of complex configuration types for
    Configuration Report
  * Tagging directly from report issue page
  * Timeline feature
  * Users can now generate API tokens
  * Anti-spam feature to limit the number of issues from new users
  * Memo custom fields
  * jQuery and jQueryUI are now included in core
  * PHP version compatibility up to PHP 5.6 and PHP 7.
  * Better generated HTML, relying on CSS instead of inline styles
    and reducing use of tables for layout
  * HTML5 doctype – Lots of improvements to generated markup.
  * Out-of-the-box support for Oracle (oci8)
  * Greatly enhanced support for PostgreSQL
  * Improved installation and admin utilities (system check, tools)
  * Mechanism to prevent concurrent updates to the same issue
  * Detailed filters hidden by default
  * Improved XmlImportExport core plugin
  * Bigger e-mail and realname fields
  * Improved documentation, migrated to Publican
  * Improved email notifications when an issue is unassigned or re-assigned
  * Support attaching files while adding a note + attaching multiple files with same name
  * Added new log level LOG_EMAIL_VERBOSE.
  * Extensibility, add more events
- Security fixes:
  * CVE-2016-5364: Reflected XSS inside
    manage_custom_field_edit_page.php [boo#984334]
  * Cannot change password in second enter to verification page
  * bugnote actions in view bug page should send data as POST
  * CVE-2014-9759: SOAP API can be used to disclose confidential settings
  * CVE-2014-9572: Improper Access Control in install.php
  * CVE-2014-9571: XSS in install.php
  * CVE-2015-1042: URL redirection issue
  * CVE-2014-9573: SQL Injection in manage_user_page.php
  * PHP remote code execution in install.php
  * CVE-2014-9701: XSS vulnerability in permalink_page.php
  * Registrations by bots via captcha exploit
  * Support Content-Security-Policy (CSP) per W3C specification
  * install.php: do not send the value of crypto_master_salt over http
  * Redirect user to change password if logged in with default admin password
  * plugins directory must be secured/fixed
  * Provide additional random number generators
  * allow_reporter_reopen lets reporter make any update, not just reopen
  * Add support for Strict-Transport-Security header
  * Improve random number generation with openssl_random_pseudo_bytes
  * Do not allow to send a reminder on a private issue to users under threshold
  * Remove input side XSS validation of user real names
  * When user reports an issue, the unpermitted project can be selected
  * Remove all inline JavaScript from MantisBT (use external scripts instead)
- Deprecated Features:
  * Custom Functions in favor of Plugins
  * DB2 support – removed in 2.0.x
  * News feature – already deprecated
  * Time tracking – already deprecated
  * Project Docs – already deprecated
  * Sponsorships – already deprecated
- Removed Features:
  * Built-in source code integration support
  * FTP for attachments
  * Removed nusoap in favor of native php soap extension
  * Removed feature extended project browser

-------------------------------------------------------------------
Mon Feb 23 11:39:33 UTC 2015 - astieger@suse.com

- MantisBT 1.2.19:
  This release resolves 5 security issues and fixes 2 regressions
  introduced in 1.2.18.
  * [security] CVE-2014-9573: SQL Injection in manage_user_page.php
  * [security] CVE-2014-9624: CAPTCHA bypass is way easier than it should be
  * [security] CVE-2015-1042: URL redirection issue
  * [security] CVE-2014-9571: XSS in install.php
  * [security] CVE-2014-9572: Improper Access Control in install.php
  * [bugtracker] Reporting an issue gives: 'Invalid argument supplied for foreach()' in '/opt/mantisbt-1.2.18/core/gpc_api.php' line 259
  * [email] Order of notes in email notifications seem to be based on user who triggered the action
  * [bugtracker] Fix handling of due dates
  * [administration] Installer UI tweaks
  * [bugtracker] Sort bug notes by date, not by ID
  * [authentication] User creation with captcha broken by fix for issue 0017811
- includes changes from MantisBT 1.2.18:
  This release resolves 23 security-related bugs and vulnerabilities:
  * 7 Cross-Site Scripting (XSS) issues
  * 2 Code injection issues
  * 2 SQL injection (XSS) issues
  * 5 Information disclosure issues
  - 7 Other security issues
  * [security] CVE-2014-8986: adm_config_report.php filtering does not check config option is valid
  * [security] CVE-2014-9117: CAPTCHA bypass
  * [security] CVE-2014-9089: SQL injection in view_all_set.php
  * [security] Multiple vulnerabilities in MantisBT
  * [security] CVE-2014-9279: Db Credentials leak via unattended upgrade script
  * [security] CVE-2014-9281: Reflected XSS in admin panel / copy_field.php
  * [security] CVE-2014-9271: Persistent XSS in file uploads/attachments
  * [security] CVE-2014-9280: PHP Object Injection in filter API
  * [security] CVE-2014-9272: XSS in string_insert_hrefs allows script execution
  * [security] CVE-2014-6316: URL redirection issue
  * [security] Emails on relations is send to people who cannot see the related issue
  * [security] CVE-2014-8553: SOAP API: leak of user personal information
  * [security] Login_page.php: Ensure username is valid
  * [security] CVE-2014-6387: Null byte poisoning in LDAP authentication
  * [security] CVE-2014-8988: Attachments can be downloaded without permission
  * [security] Prevent unauthorized users setting handler when reporting issue
  * [other] Incorrect $specific_where
  * [documentation] Code allows display of Resolution and Status in bug report page, but doc says it's not allowed
  * [code cleanup] Use of deprecated PREG_REPLACE_EVAL ('e') pattern modifier
  * [attachments] Warning in bug report when attachments are disabled
  * [attachments] Debug output displayed when adding files
  * [bugtracker] proj_doc_update.php on document update crashes if new file is not uploaded
  * [bugtracker] Missing error param when updating project doc
  * [filters] Column summary of the free text search is not prefixed by table (filter_api)
  * [bugtracker] Default profile doesn't work
  * [security] No Errors shown at all if error_reporting=0 configured at server
  * [bugtracker] Invalid category check is not made
  * [news] News section shouldn't show in permissions report when feature is disabled
  * [api soap] Handler can be set without having appropriate access rights
  * [db mssql] Graph « Cumulative by date » is not displayed in Summary > Advanced Summary
  * [migration] Import plugins should be able to set last_updated field to a date in the past
  * [bugtracker] Issue history show date submitted and last updated as integers rather than dates
  * [bugtracker] New BugData object due_date should be blank
  * [plug-ins] XML import plugin only replaces links in 'description'
  * [security] CVE-2014-7146 : PHP Code Injection Vulnerability in XmlImportExport plugin
  * [security] Attachments displayed in history despite user not authorised to view them
  * [api soap] mc_issue_update() email notification doesn't include added notes
  * [security] CVE-2014-8598: XML plugin should restrict ability to import data
  * [api soap] CVE-2014-8554: SQL injection in SOAP API
  * [security] CVE-2014-9269: XSS in extended project browser
  * [security] CVE-2014-8987: XSS in adm_config_report.php
  * [security] CVE-2014-9270: Stored XSS in Mantis
  * [email] Disposable library triggers PHP STRICT warnings
  * [news] Not possible to set 'announcement' flag when editing News
- Fix XSS in adm_config_report.php
  - mantisbt-1.2.19-CVE-2015-2046.patch CVE-2015-2046 [boo#919035]

-------------------------------------------------------------------
Wed Oct  8 18:37:57 UTC 2014 - andreas.stieger@gmx.de

- MantisBT 1.2.17:
  * undefined function db_params() in core/news_api.php
  * The bug_get_bugnote_count() function in the bug API always
    returns 0
  * duplicate "<a " tag
  * [security] CVE-2014-2238: SQL injection vulnerability in
                adm_config_report.php
- includes changes from 1.2.26, including:
    [security] CVE-2014-1609: SQL injection vulnerabilities
  * [security] CVE-2014-1608: soap:Envelope SQL injection attack
  * [security] When $g_limit_reporters = ON; it is still possible
               to change reporter
  * [security] CVE-2013-4460: XSS in account_sponsor_page.php
               project names
  * For a full list, see
    http://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=1.2.16
- clean up spec file
- verify source signature

-------------------------------------------------------------------
Thu Aug  8 21:01:23 UTC 2013 - robert.munteanu@gmail.com

- Rename changes file to package name
- Do not package the root directory in both main and -install
  package 
- Update summary and description
- Do not package build and test files
- Corrected license name

-------------------------------------------------------------------
Fri Oct  7 21:38:44 UTC 2011 - mrdocs@opensuse.org

-Update to 1.2.8
 +numerous bugfxes and security updates
- Versioned changelogs 1.2.4 - 1.2.8:
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=139 
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=138
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=137
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=114
- http://www.mantisbt.org/bugs/changelog_page.php?version_id=133
- renamed spec file to eliminate rpmlint warning

-------------------------------------------------------------------
Wed Jan 12 16:25:22 UTC 2011 - nix@opensuse.org

- Update to version 1.2.4
- Delete useless .gitignore
- Disable rpmlint check for zero length *.html files
- change file ownership to root instead of apache!!

-------------------------------------------------------------------
Fri Jun  11 15:09:58 UTC 2010 - rpms@ilmi.fi - 1.2.1

- Update to version 1.2.1

-------------------------------------------------------------------
Mon Mar  8 15:09:58 UTC 2010 - nix@opensuse.org

- Update to version 1.2.0
- Migrate changelog to changes file

-------------------------------------------------------------------
* Mon Dec 08 2008 Tuukka Pasanen <rpms@ilmi.fi> - 1.1.5
- New version 1.1.5.
- Name changed
- Directories added

* Wed Jun 25 2008 Tuukka Pasanen <rpms@ilmi.fi> - 1.1.2
- New version 1.1.2

* Wed Jan 16 2008 Tuukka Pasanen <rpms@ilmi.fi> - 1.1.0
- Separate Admin package.

* Tue Jul 10 2007 Tuukka Pasanen <rpms@ilmi.fi> - 1.0.8
- New version 1.0.8

* Wed Feb 28 2007 Tuukka Pasanen <rpms@ilmi.fi> - 1.0
- Initial build

Places

File mantisbt.changes of Package mantisbt (Revision 62e918531261cb3a214ad5d6b29a2b69)

Places