mantisbt · Sep 5, 2011 · Sep 5, 2011 · Sep 5, 2011
Showing with 27 additions and 4 deletions.

+1 −1 bug_report_page.php

+1 −1 config_defaults_inc.php

+1 −1 core/constant_inc.php

+1 −1 core/filter_api.php

+23 −0 doc/RELEASE
diff --git a/bug_report_page.php b/bug_report_page.php
@@ -56,7 +56,7 @@
 		$t_bug = bug_get( $f_master_bug_id, true );
 
 		# the user can at least update the master bug (needed to add the relationship)...
-		access_ensure_bug_level( config_get( 'update_bug_threshold', null, $t_bug->project_id ), $f_master_bug_id );
+		access_ensure_bug_level( config_get( 'update_bug_threshold', null, null, $t_bug->project_id ), $f_master_bug_id );
 
 		#@@@ (thraxisp) Note that the master bug is cloned into the same project as the master, independent of
 		#       what the current project is set to.

diff --git a/config_defaults_inc.php b/config_defaults_inc.php
@@ -113,7 +113,7 @@
 		}
 
 		$t_self = $_SERVER['SCRIPT_NAME'];
-		$t_self = filter_var( $t_self, FILTER_SANITIZE_STRING );
+		$t_self = trim( str_replace( "\0", '', $t_self ) );
 		$t_path = str_replace( basename( $t_self ), '', $t_self );
 		$t_path = basename( $t_path ) == "admin" ? dirname( $t_path ) . '/' : $t_path;
 		$t_path = basename( $t_path ) == "soap" ? dirname( dirname( $t_path ) ) . '/' : $t_path;

diff --git a/core/constant_inc.php b/core/constant_inc.php
@@ -14,7 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with MantisBT.  If not, see <http://www.gnu.org/licenses/>.
 
-define( 'MANTIS_VERSION', '1.2.7' );
+define( 'MANTIS_VERSION', '1.2.8' );
 
 # --- constants -------------------
 # magic numbers

diff --git a/core/filter_api.php b/core/filter_api.php
@@ -4484,7 +4484,7 @@ function filter_db_get_filter( $p_filter_id, $p_user_id = null ) {
 		}
 
 		# check that the user has access to non current filters
-		if(( ALL_PROJECTS <= $row['project_id'] ) && ( !is_blank( $row['name'] ) ) && ( !access_has_project_level( config_get( 'stored_query_use_threshold', $row['project_id'], $t_user_id ) ) ) ) {
+		if(( ALL_PROJECTS <= $row['project_id'] ) && ( !is_blank( $row['name'] ) ) && ( !access_has_project_level( config_get( 'stored_query_use_threshold', null, $t_user_id, $row['project_id'] ) ) ) ) {
 			return null;
 		}
 

diff --git a/doc/RELEASE b/doc/RELEASE
@@ -1,5 +1,27 @@
 MantisBT Release Notes
 
+1.2.8 Security Release (2011-09-05)
+-------------------------------------------------
+
+MantisBT 1.2.8 is a security update for the stable 1.2.x branch. All
+installations that are currently running any 1.2.x version are advised to
+upgrade to this release.
+
+Paulino Calderon from Websec, High-Tech Bridge Security Research Lab and Paul
+Richards discovered 3 vulnerabilities:
+ - 1x local file inclusion (LFI)/directory traversal
+ - 2x cross site scriptin (XSS)
+
+These vulnerabilities could have very severe consequences for users of
+MantisBT, particularly as a result of the local file inclusion vulnerability.
+If an attacker can upload their own PHP script to the server as an attachment,
+they may be able to execute this script using the LFI vulnerability.
+
+Refer to issues #13191 and #13281 for detailed information.
+
+A full changelog for the 1.2.x series can be found on the official site. [1]
+
+
 1.2.7 Security Release (2011-08-19)
 -------------------------------------------------
 
@@ -182,6 +204,7 @@ There have also been many improvements to the codebase beyond adding features:
 
 [1] The changelog is split between multiple releases:
 
+	1.2.8      http://www.mantisbt.org/bugs/changelog_page.php?version_id=139
 	1.2.7      http://www.mantisbt.org/bugs/changelog_page.php?version_id=138
 	1.2.6      http://www.mantisbt.org/bugs/changelog_page.php?version_id=114
 	1.2.5      http://www.mantisbt.org/bugs/changelog_page.php?version_id=113