mantisbt/mantisbt — pull request #542 by vboctor (2014-11-05 05:05:23+00:00)
Title: Handler access checks in SOAP API

The mc_issue_add() and mc_issue_update() APIs were missing checks to validate that specified handler has the appropriate access level and that logged in user have access level to assign issues.

mc_issue_get() was also missing the check that the user has access to view the handler assigned the issue.

I suggest that we port this fix to master-1.2.x to make it in 1.2.18.

Fixes #16993