CVE-2012-1119 (published 2012-06-29T19:55Z)

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: Damien Regad
author_date: 2012-03-01 22:58:00+01:00
msg: Fix #13816: Update history when copying issues

Until now, copying bugs using the "View Issues" page creates wrong/
incomplete history (entries for notes reflect the id's of the original
issue's notes) and also does not record any trace that the new issue is
in fact clone of another, which can be a source of confusion.

This commit prevents the duplication of the original bug's history,
generating instead a single history entry similar to what happens when
cloning a bug with the Clone button in view.php page.

The display of history entries for cloned bugs has been slightly
modified, the bug id is now printed under the 'Field' column instead of
the 'Change' column, like entries for adding notes (as cloning s not a
change).
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: bug_actiongroup.php
change_type: ModificationType.MODIFY
diff: @@ -150,7 +150,8 @@ foreach( $f_bug_arr as $t_bug_id ) {
 		$f_project_id = gpc_get_int( 'project_id' );
 
 		if ( access_has_project_level( config_get( 'report_bug_threshold' ), $f_project_id ) ) {
-			bug_copy( $t_bug_id, $f_project_id, true, true, true, true, true, true );
+			# Copy everything except history
+			bug_copy( $t_bug_id, $f_project_id, true, true, false, true, true, true );
 		} else {
 			$t_failed_ids[$t_bug_id] = lang_get( 'bug_actiongroup_access' );
 		}

programming_language: PHP
filename: bug_api.php
change_type: ModificationType.MODIFY
diff: @@ -907,6 +907,10 @@ function bug_check_workflow( $p_bug_status, $p_wanted_status ) {
  * @param int p_target_project_id
  * @param bool p_copy_custom_fields
  * @param bool p_copy_relationships
+ * @param bool p_copy_history
+ * @param bool p_copy_attachments
+ * @param bool p_copy_bugnotes
+ * @param bool p_copy_monitoring_users
  * @return int representing the new bugid
  * @access public
  */
@@ -1054,6 +1058,10 @@ function bug_copy( $p_bug_id, $p_target_project_id = null, $p_copy_custom_fields
 		}
 	}
 
+	# Create history entries to reflect the copy operation
+	history_log_event_special( $t_new_bug_id, BUG_CREATED_FROM, '', $t_bug_id );
+	history_log_event_special( $t_bug_id, BUG_CLONED_TO, '', $t_new_bug_id );
+
 	return $t_new_bug_id;
 }
 

programming_language: PHP
filename: history_api.php
change_type: ModificationType.MODIFY
diff: @@ -556,12 +556,10 @@ function history_localize_item( $p_field_name, $p_type, $p_old_value, $p_new_val
 					}
 					break;
 				case BUG_CLONED_TO:
-					$t_note = lang_get( 'bug_cloned_to' );
-					$t_change = bug_format_id( $p_new_value );
+					$t_note = lang_get( 'bug_cloned_to' ) . ': ' . bug_format_id( $p_new_value );
 					break;
 				case BUG_CREATED_FROM:
-					$t_note = lang_get( 'bug_created_from' );
-					$t_change = bug_format_id( $p_new_value );
+					$t_note = lang_get( 'bug_created_from' ) . ': ' . bug_format_id( $p_new_value );
 					break;
 				case TAG_ATTACHED:
 					$t_note = lang_get( 'tag_history_attached' ) . ': ' . $p_old_value;

programming_language: PHP
repo_url: https://github.com/mantisbt/mantisbt
commit_details: repo_url: https://github.com/mantisbt/mantisbt
author: Damien Regad
author_date: 2012-03-02 16:28:33+01:00
msg: Add "New Issue" entry to history when copying bugs

When bug_copy() is called with p_copy_history=false, a 'NEW_BUG' history
entry is added to ensure consistency of behavior with Clone button.

Fixes #13816
repository: repo_url: https://github.com/mantisbt/mantisbt
repo_name: mantisbt/mantisbt
description: Mantis Bug Tracker (MantisBT)
repo_language: PHP
owner: mantisbt
file_changes: filename: bug_api.php
change_type: ModificationType.MODIFY
diff: @@ -1037,6 +1037,8 @@ function bug_copy( $p_bug_id, $p_target_project_id = null, $p_copy_custom_fields
 	# COPY HISTORY
 	history_delete( $t_new_bug_id );	# should history only be deleted inside the if statement below?
 	if( $p_copy_history ) {
+		# @todo problem with this code: the generated history trail is incorrect because the note IDs are those of the original bug, not the copied ones
+		# @todo actually, does it even make sense to copy the history ?
 		$query = "SELECT *
 					  FROM $t_mantis_bug_history_table
 					  WHERE bug_id = " . db_param();
@@ -1056,6 +1058,9 @@ function bug_copy( $p_bug_id, $p_target_project_id = null, $p_copy_custom_fields
 						  		   " . db_param() . " );";
 			db_query_bound( $query, Array( $t_bug_history['user_id'], $t_new_bug_id, $t_bug_history['date_modified'], $t_bug_history['field_name'], $t_bug_history['old_value'], $t_bug_history['new_value'], $t_bug_history['type'] ) );
 		}
+	} else {
+		# Create a "New Issue" history entry
+		history_log_event_special( $t_new_bug_id, NEW_BUG );
 	}
 
 	# Create history entries to reflect the copy operation

programming_language: PHP