Furthermore, any email notification lists all relationsships, even those the user should not see!

Targetting for 1.3 with possibilty of backporting as a bugfix.

I would have hoped that you consider it also a security issue that should definitely be solved in 1.2.x, even if it does not block 1.2.0. Well, let's see...

Fixing this would require relationship_get_details having details of the current user (to use with access_has_bug_level).

I know I had some positive feedback from atrol when considering moving towards a "MantisContext" class to track this sort of stuff.

We probably need to decide on if we are going to move to that approach, before fixing this - otherwise it's a case of adding user_id, project_id all the way through the chains

IIRC "MantisContext" class was some kind of more elegant method to set/save/restore/get values of a collection of global variables. But it would be still quite easy to use it the wrong way.
There is no big difference between calling a SetContext method and setting $g_project_override.

I prefer in a first step to have user_id and project_id at least for the low level functions as non optional parameters. Thus it's clear for a developer that he has to think about project and user when using such a function.

Introducing a new concept (which might break plugins) is probably nothing that should be done in 1.3.

Here is a proposed fix.
https://github.com/mantisbt/mantisbt/pull/520

Are you planning to backport this to 1.2 ? I think we should, as it's a security-related bugfix.

@dregard, I've ported the fix to master-1.2.x.