Fix #17870: XSS in adm_config_report.php
Force reporting of E_USER_* in error api

Solves the problem of Mantis silently proceeding through errors that
should effectively stop code execution, when error_reporting is disabled
in php.ini or apache mod config.

This follows @davidhicks recommendation in comment ~22998.

Fixes #10966

Backported from master cec454931df5a99d03ff22aabf8901648ff3d549.
adm_config_report: invalid config handling

When receiving an invalid config_id, the page will default the select to
[any] (META_FILTER_NONE) instead of adding the invalid config to the
list.

This is a backport of cabacdc291c251bfde0dc2a2c945c02cef41bf40 and
3d0625d84d5d08a998673713df1711e1d46b0b86 from master.

Fixes #17889
SOAP API: apply access control to mci_account_get_array_by_id

The access controls are the same as the ones applied by
view_user_page.php, with the single addition of making the info
available if the user requests their own information.

This preserves the behaviour of the mc_login method call.

Fixes #17243 (leak of user personal information)

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Prevent unauthorized users setting handler when reporting issue

Adding a security check to block the update when access level is
insufficient.

Fixes #17878

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Ensure username is valid in login_page.php

This is a fix to improve the behaviour of login_page against possible
XSS exploits to ensure that a username is valid before displaying it
back to the user when entered.

Fixes #17338

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Revert "Fix #17870: XSS in adm_config_report.php"

This reverts commit ee8100d6752b9c5dc0dd360a2d903211c5f9eba7.

The wrong string API call was used, it should have been
string_attribute() and not string_display_line(). Thanks to
Paul Richards for pointing this out.
Fix #17870: XSS in adm_config_report.php

This is the correct fix for this issue, using string_attribute() to
escape the variable. Thanks to Paul Richards for pointing this out.
Incorrect access check on attachment downloads

Even if config variables $g_download_attachments_threshold and
$g_view_attachments_threshold are set to 55 (developer), users with
lower privileges can download attachments.

Fixes #17742

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix bug doesn't exist error in timeline feature

The error was caused by 0f030fd725b8139aa39e47365fe3433a2f12dda8 which checks that the user has access to issues referenced in issue history.

Issue #9885

Conflicts:
	core/history_api.php
Improve validation for filter sort and direction

Fixes #17841
Use session rather than form key for captcha

Fixes #17811

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Increase captcha public key max value

The captcha's public key was generated as a random number between 0 and
99999.

As per Alejo Popovici's recommendation in ~41918, this commit removes
the limitation in mt_rand() call, so the generated key is now a number
between 0 and mt_getrandmax() (2147483647 on my box).

Issue #17811
Allow setting 'announcement' flag when editing News

News Edit was not working - boolean was being interpreted as a string

Fixes #17924

Signed-off-by: Damien Regad <dregad@mantisbt.org>
DB Credentials leak in upgrade_unattended.php

Retrieve credentials from Mantis system configuration instead of
accepting them from POST parameters.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Paul Richards' original patch was modified to align the code with master
branch to (basically replacing DIRECTORY_SEPARATOR by '/') to facilitate
porting.

Fixes #17877

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Do not pass raw user data to unserialize

Filters were moved to TOKEN api, so the code in current_user_api to handle
?filter= on URL query strings is a left over from this move and is no
longer necessary.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Fixes #17875

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix: Javascript error in extended project browser
Fix #17890: XSS in extended project browser

Extended project browser allows projects to be passed in as A;B.
helper_get_current_project() and helper_get_current_project_trace() then
explodes the string by ';' and don't check that A is an int (a project /
sub-project id).  Finally, print_extended_project_browser() prints the
result of the split into a javascript array.

Paul Richards discovered the issue and wrote the original patch for it.
His code was modified to remove a redudant typecast as well as an
unnecessary foreach loop in helper_get_current_project(), replacing it
with a single type cast.
Fix #17583: XSS in projax_api.php

Offensive Security reported this issue via their bug bounty program [1].

The Projax library does not properly escape html strings.  An attacker
could take advantage of this to perform an XSS attack using the
profile/Platform field.

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix #17876: XSS in copy_field.php

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>