gmane.comp.bug-tracking.mantis.announce

MantisBT 1.2.15 Released

Victor Boctor — 2013-04-14T01:30:32

Blog Post: http://www.mantisbt.org/blog/?p=249

MantisBT 1.2.15 is a security update for the stable 1.2.x branch.
All installations that are currently running any 1.2.x version are strongly
advised to upgrade to this release.

The following security issues were resolved:

   - Any malicious user could use the view issues page (search.php) to
   execute a filter that could bring down the site by overloading the
   database server (CVE-2013-1883). Affects MantisBT 1.2.12 and later.  Refer
   to issue #15573 <http://www.mantisbt.org/bugs/view.php?id=15573> for
   detailed information.
   - A cross site scripting (XSS) vulnerability allowed execution of
   arbitrary JavaScript code when deleting a version. Affects MantisBT
   1.2.14 and later. Refer to issue
#15511<http://www.mantisbt.org/bugs/view.php?id=15511> for
   detailed information.
   - In some cases, the ‘Close’ button would be available to unauthorized
   users, allowing them to close issues at will, bypassing the workflow
   settings. Affects Man

MantisBT 1.2.14 Released

Victor Boctor — 2013-01-31T07:23:12

Blog Post: http://www.mantisbt.org/blog/?p=244

MantisBT 1.2.14 is a security update for the stable 1.2.x branch.
All installations that are currently running any 1.2.x version are strongly
advised to upgrade to this release.

The following release notes are relative to 1.2.12 (rather than 1.2.13).

Four cross site scripting (XSS) vulnerability issues were discovered
and resolved:

   - A malicious person could trick a target user’s browser into
   executing arbitrary JavaScript code (CVE-2013-0197). This vulnerability is
   critical, due to the affected page (search.php) being usable anonymously on
   public-facing installations (i.e. without the need for a user login).
    Affects MantisBT 1.2.12 only (earlier versions are not impacted).  Refer
   to issue #15373 <http://www.mantisbt.org/bugs/view.php?id=15373> for
   detailed information.
   - A user holding manager/administrator permissions could create a
   category or project name containing JavaScript code; from that point on,
   visitors to (a) the

MantisBT 1.2.13 Release (security release)

Victor Boctor — 2013-01-23T06:55:18

blog post: http://www.mantisbt.org/blog/?p=236

MantisBT 1.2.13 is a security update for the stable 1.2.x branch.
All installations that are currently running any 1.2.x version are strongly
advised to upgrade to this release.

Two cross site scripting (XSS) vulnerability issues affecting MantisBT
1.2.12 only (earlier versions are not impacted) were discovered:

   - *CVE-2013-0197*: a malicious person could trick the browser of a
   target user into executing arbitrary JavaScript code. This vulnerability
   is particularly wide-reaching due to the affected page (search.php) being
   usable anonymously on public-facing installations (i.e. no user login
   required).  Refer to issue
#15373<http://www.mantisbt.org/bugs/view.php?id=15373> for
   detailed information.
   - *CVE-2013-XXXX*: A user holding manager/administrator permissions
   could create a category or project name containing JavaScript code; from
   that point on,  visitors to the Summary page (summary.php) are exposed to
   having the JavaScript

MantisBT 1.2.12 Released

Victor Boctor — 2012-11-12T02:21:22

MantisBT 1.2.12 is a maintenance update for the stable 1.2.x branch that
resolves over 70 issues mainly in the following categories: security, MS
SQL and PostgreSQL database support, change log page, custom fields,
installation, attachments, SOAP API (including
MantisTouch<http://www.mantistouch.org/> related fixes),
XML import/export plugin, email (including update of phpMailer to v5.2.1)
and others.

All installations that are currently running any 1.2.x or older version
are advised to upgrade to this release.

A full changelog for 1.2.12 can be found at
here<http://www.mantisbt.org/bugs/changelog_page.php?version_id=150>.
 Go ahead and download <http://www.mantisbt.org/download.php> it now.

For optimized access to MantisBT from iPhone, Android and Windows Phone
checkout MantisTouch <http://www.mantistouch.org/>.

Cheers,
-MantisBT Team
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download

MantisBT 1.2.11 Released

Victor Boctor — 2012-06-09T07:04:38

MantisBT 1.2.11 is a security update for the stable 1.2.x branch.
All installations that are currently running any 1.2.x or older version
are advised to upgrade to this release.

This release also contains numerous minor bug fixes to MantisBT, SOAP API
fixes, enhancements to the admin guide and improved translations in
many languages.

The SOAP API fixes also addresses the
MantisTouch<http://www.mantistouch.org/> “login
failure” error that was caused by php warnings in configuration that was
surfaced in the SOAP API but not the web interface.

A full changelog for 1.2.11 can be found at
here<http://www.mantisbt.org/bugs/changelog_page.php?version_id=148>.
 Go ahead and download <http://www.mantisbt.org/download.php> it now.

For optimized access to MantisBT from iPhone, Android and Windows Phone
checkout MantisTouch <http://www.mantistouch.org/>.

Cheers,
-MantisBT Team
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event wil

MantisBT 1.2.10 released

Victor Boctor — 2012-04-02T00:34:09

MantisBT 1.2.10 is a maintenance release. All installations that are
currently running any 1.2.x version or older are advised to upgrade to this
release.

A full changelog for 1.2.10 can be found at:
http://www.mantisbt.org/bugs/changelog_page.php?version_id=146

The release can be downloaded at:
http://www.mantisbt.org/download.php

Checkout Hosted MantisBT <http://www.mantisbt.org/hosting.php> to be up and
running in minutes.  For optimized access to MantisBT from iPhone, Android
and Windows Phone checkout MantisTouch <http://www.mantistouch.org/>.

Cheers,
-Mantis Team
------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure_______________________________________________
mantisbt-announce mailing list
mantisbt-announce-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/mantisbt-announce

MantisBT 1.2.9 released

Victor Boctor — 2012-03-04T06:29:46

MantisBT 1.2.9 release delivers 92 fixes and improvements including
security fixes, new MantisBT logo,
MantisTouch<http://www.mantisbt.org/mantistouch.php> integration,
MS SQL fixes, SOAP API improvements, and others.  We recommend that all
instances be upgraded to this release.

A full changelog for 1.2.9 can be found at:
http://www.mantisbt.org/bugs/changelog_page.php?version_id=140

The release can be downloaded at:
http://www.mantisbt.org/download.php

For optimized access to MantisBT from iPhone, Android and Windows Phone
checkout MantisTouch <http://www.mantisbt.org/mantistouch.php>.

Cheers,
-Mantis Team
------------------------------------------------------------------------------
Virtualization & Cloud Management Using Capacity Planning
Cloud computing makes use of virtualization - but cloud computing 
also focuses on allowing computing to be delivered as a service.
http://www.accelacomm.com/jaw/sfnl/114/51521223/_______________________________________________
mantisbt-announce mailing list
mantisbt

New IRC Channels

John Reese — 2011-09-26T14:24:33

Howdy All,

I would like to announce a some changes to the IRC channels used for the 
MantisBT project.  I've registered a formal MantsBT group with Freenode, 
which has given us control of the mantisbt "namespace".

This means that we now have the #mantisbt channel, which will be used 
specifically for development discussions and random off topic chatter.

Our existing IRC channel #mantishelp is being moved to #mantisbt-help, 
and will be reserved for questions and support for end users.  The 
current #mantishelp channel is set up to forward users appropriately, 
but will be disbanded after a few weeks time.  The web client on 
mantisbt.org is already updated to send users to the correct channel.

Please update your IRC clients with the new channels names.

Cheers

MantisBT 1.2.8 Released

John Reese — 2011-09-06T14:42:57

Hi all,

MantisBT 1.2.8 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised 
to upgrade to this release.

Paulino Calderon from Websec, High-Tech Bridge Security Research Lab and 
Paul Richards discovered 3 vulnerabilities:
  - 1x local file inclusion (LFI)/directory traversal
  - 2x cross site scriptin (XSS)

These vulnerabilities could have very severe consequences for users of
MantisBT, particularly as a result of the local file inclusion 
vulnerability. If an attacker can upload their own PHP script to the 
server as an attachment, they may be able to execute this script using 
the LFI vulnerability.

Refer to issues #13191 and #13281 for detailed information:

   http://www.mantisbt.org/bugs/view.php?id=13191
   http://www.mantisbt.org/bugs/view.php?id=13281

A full changelog for 1.2.8 can be found at:

   http://www.mantisbt.org/bugs/changelog_page.php?version_id=139

The release can be downloaded at:

   http://www.mantisbt.org/d

MantisBT 1.2.7 Released

John Reese — 2011-08-22T14:54:24

Howdy all,

MantisBT 1.2.7 is a security update for the stable 1.2.x branch. All 
installations that are currently running any 1.2.x version are advised 
to upgrade to this release.

Net.Edit0r from BlACK Hat Group posted a vulnerability report for an XSS 
issue in search.php. All MantisBT users (including anonymous users that 
are not logged in to public bug trackers) could be impacted by this 
vulnerability. Refer to issue #13245 [1] for full details.

This release also contains numerous minor bug fixes to MantisBT and 
improved translations in many languages.

A full changelog for 1.2.7 can be found on the official site:
   http://www.mantisbt.org/bugs/changelog_page.php?version_id=138

The release can be downloaded from:
   http://www.mantisbt.org/download.php

[1] http://www.mantisbt.org/bugs/view.php?id=13245

Cheers

MantisBT 1.2.6 Released

John Reese — 2011-07-26T14:08:12

Hi all,

MantisBT 1.2.6 is a maintenance update for the stable 1.2.x branch. It 
is recommended that all MantisBT users (including those still using 
1.1.x or earlier versions) upgrade to this latest release.

This release brings bug fixes and improvements across a range of 
MantisBT features, especially the SOAP API, authentication, time 
tracking, and billing areas. Documentation and translation updates are 
also included.

A full changelog for 1.2.6 can be found on the official site:
    http://www.mantisbt.org/bugs/changelog_page.php?version_id=114

The release is available for download at:
    http://www.mantisbt.org/download.php

Cheers

MantisBT Moving to Github

John Reese — 2011-07-12T18:30:45

Hi all,

I'd like to announce that as of now, the primary Git repositories for 
the MantisBT project are hosted at Github [1], using the "mantisbt" 
organization for all official code repositories.  I've also renamed the 
development tools repository from "mantisbt-dev" to "mantisbt-tools" for 
sake of clarity.  Commit emails will now be sent to the mantisbt-cvs 
list from noreply-9UaJU3cA/F/QT0dZR+AlfA< at >public.gmane.org rather than git-yNRIyJjUR0xg9hUCZPvPmw< at >public.gmane.org

Regarding plugins, I've have created a second organization on Github 
called "mantisbt-plugins" [2].  Community members with plugins are 
welcome to join the organization and have their repositories hosted 
there as a sort of "official list" of available plugins.  Simply send a 
request to the developer list, and we will add your Github account and 
create a repository that you can push to.  Any plugins currently hosted 
on git.mantisforge.org will continue to be available, although we would 
encourage moving them to Github as time perm

MantisBT 1.2.5 Released

John Reese — 2011-04-05T19:12:53

Hi all,

MantisBT 1.2.5 is a maintenance update for the stable 1.2.x branch. It 
is recommended that all MantisBT users (including those still using 
1.1.x or earlier versions) upgrade to this latest release.

This release brings improved translations in many languages as well as 
numerous bug fixes across a range of MantisBT features.

A full changelog for 1.2.5 can be found on the official site:
    http://www.mantisbt.org/bugs/changelog_page.php?version_id=113

The release is available for download at:
    http://www.mantisbt.org/download.php

Cheers

MantisBT 1.2.4 Released

John Reese — 2010-12-15T02:37:57

Howdy all,

MantisBT 1.2.4 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised to
upgrade to this release.

Gjoko Krstic of Zero Science Lab reported multiple vulnerabilities in the
admin/upgrade_unattended.php script. Issue #12607 provides more detail on the
vulnerabilities discovered. We thank Gjoko for his detailed assistance with
testing, patching and answering questions. Please note that the /admin/
directory should be removed from all MantisBT installations after the
installation or upgrade has been completed. This is particularly true for
MantisBT installations accessible over the Internet.

Also included with 1.2.4 are some bug fixes relating to fonts in the
MantisGraph plugin, SOAP API, CSV export, custom field values, relationship
graphs, fields on the manage user page, built-in time tracking and the
allow_reporter_close feature. This release includes updated translations for
many languages and improved installation documentat

MantisBT 1.2.3 Released

John Reese — 2010-09-14T18:56:51

Howdy folks,

MantisBT 1.2.3 is a security update for the stable 1.2.x branch. All 
installations that are currently running any 1.2.x version are advised 
to upgrade to this release.

Issue #12312 covers an XSS vulnerability in the upstream NuSOAP library. 
The fix has been applied to the library included in MantisBT releases, 
and a patch has been submitted upstream for future releases of NuSOAP. 
See http://www.mantisbt.org/bugs/view.php?id=12312 for further details.

Also included with 1.2.3 are another round of XSS fixes to MantisBT, 
improved excel export, translation updates, and bug fixes to the SOAP 
API, installation, plugin system, and email notifications.

The release changelog can be found at:
  - http://www.mantisbt.org/bugs/changelog_page.php?version_id=111

It can be downloaded at:
  - http://www.mantisbt.org/download.php

Cheers

MantisBT 1.2.2 Released

John Reese — 2010-07-29T17:25:57

Howdy all,

MantisBT 1.2.2 is a security update for the stable 1.2.x branch. All 
installations that are currently running any 1.2.x version are advised 
to upgrade to this release.

Issue #11952 covers a security fix to the display of inline attachments, 
where "Arbitrary inline attachment rendering could lead to cross-domain 
scripting or other browser attacks".  See 
http://www.mantisbt.org/bugs/view.php?id=11952 for further details and 
information.

Also included with 1.2.2 are a range of translation updates, regression 
fixes, and bug fixes, including multiple SOAP API-related bugs and 
regressions.

The release changelog can be found at:
     - http://www.mantisbt.org/bugs/changelog_page.php?version_id=110

It can be downloaded at:
     - http://www.mantisbt.org/download.php

Cheers

MantisBT 1.2.1 Released

John Reese — 2010-04-23T18:44:25

Hi all,

MantisBT 1.2.1 is a maintenance update for the stable 1.2.x branch. All
installations that are currently running any 1.1.x or 1.2.0 version are
advised to upgrade to this release.

Included with 1.2.1 are a range of bug fixes, translation updates, and general
improvements over the initial 1.2.0 release.  Highlights include an improved
installation, a fixed upgrade path from 1.1.x, fixes to the URL and path
detection, and updates to the plugin event system.

The release changelog can be found at:
    - http://www.mantisbt.org/bugs/changelog_page.php?version_id=109

It can be downloaded at:
    - http://www.mantisbt.org/download.php

Cheers

MantisBT 1.2.0 Released

John Reese — 2010-02-22T20:52:56

MantisBT Release Notes

1.2.0 Stable Release
-------------------------------------------------

This release marks the first official release in the 1.2.x series of MantisBT.
1.2.0 is a major feature release for MantisBT, and includes many bugfixes and
enhancements over the 1.1.x stable branch.  All users of 1.1.x are highly
encouraged to upgrade as soon as possible.

A full changelog for the 1.2.x series can be found on the official site. [1]

There are many new features added to 1.2.0, including:

  - Converted the MantisBT Manual to Docbook format, and added a new Developer's
    Guide manual, both of which are compiled and included in every release

  - Implemented a plugin system with many plugins already released [2]

  - Global categories available to all projects, as well as project categories
    inheriting from parent projects to child projects;  both are optional

  - Tracked change history for textarea fields (Description, etc) and bug notes

  - Customizable sets of columns for View Issues page

MantisBT 1.2.0rc2 Release Candidate 2

John Reese — 2009-10-07T17:02:07

MantisBT Release Notes

1.2.0 Release Candidate 2
-------------------------------------------------

This release marks the second "stable" release in the 1.2.x series of MantisBT.
The 1.2.x series is now officially feature complete, and this build is ready
for official testing in non-critical installations.  This release is a good
representation of a final 1.2.0 build.

A full changelog for the 1.2.x series can be found on the official site. [1]

There are many new features added to 1.2.x, including:

  - Converted the MantisBT Manual to Docbook format, and added a new Developer's
    Guide manual, both of which are compiled and included in every release.

  - Implemented a plugin system with many plugins already released [2]

  - Global categories available to all projects, as well as project categories
    inheriting from parent projects to child projects;  both are optional

  - Tracked change history for textarea fields (Description, etc) and bug notes

  - Customizable sets of columns for View Issues p