Fix #17870: XSS in adm_config_report.php
SOAP API: apply access control to mci_account_get_array_by_id

The access controls are the same as the ones applied by
view_user_page.php, with the single addition of making the info
available if the user requests their own information.

This preserves the behaviour of the mc_login method call.

Fixes #17243 (leak of user personal information)

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Prevent unauthorized users setting handler when reporting issue

Adding a security check to block the update when access level is
insufficient.

Fixes #17878

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Ensure username is valid in login_page.php

This is a fix to improve the behaviour of login_page against possible
XSS exploits to ensure that a username is valid before displaying it
back to the user when entered.

Fixes #17338

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Whitespace
Revert "Fix #17870: XSS in adm_config_report.php"

This reverts commit b509ab380f91e84d9683dbfdb02206b88a9b86fb.

The wrong string API call was used, it should have been
string_attribute() and not string_display_line(). Thanks to
Paul Richards for pointing this out.
Fix #17870: XSS in adm_config_report.php

This is the correct fix for this issue, using string_attribute() to
escape the variable. Thanks to Paul Richards for pointing this out.
Incorrect access check on attachment downloads

Even if config variables $g_download_attachments_threshold and
$g_view_attachments_threshold are set to 55 (developer), users with
lower privileges can download attachments.

Fixes #17742

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix alternate background color for section-container css class

Fixes #17851
Fix bug doesn't exist error in timeline feature

The error was caused by 0f030fd725b8139aa39e47365fe3433a2f12dda8 which checks that the user has access to issues referenced in issue history.

Issue #9885
Improve timeline message when issue is unassigned

Old Message: "user xyz assigned issue 123 to user0"
New Message: "user xyz unassigned issue 123"
Restyle the send reminder form

Fixes #17832

Signed-off-by: Victor Boctor <victor@mantishub.net>
Re-style search label in Manage User page

Fixes #17815

Signed-off-by: Victor Boctor <victor@mantishub.net>
Fix #17912: display of "\n" in summary submenu

Regression introduced by 0552366c6e2aff04efd4d3ada7c794b6300bb8f5.
Fix #17913: issue hyperlinks in timeline
Convert filter links into standard form buttons

Fixes #17834
Improve validation for filter sort and direction

Fixes #17841
HTML/CSS fixes in bug_revision_view_page.php
Allow setting 'announcement' flag when editing News

News Edit was not working - boolean was being interpreted as a string

Fixes #17924

Signed-off-by: Damien Regad <dregad@mantisbt.org>
DB Credentials leak in upgrade_unattended.php

Retrieve credentials from Mantis system configuration instead of
accepting them from POST parameters.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Fixes #17877

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>