View Issue Details

IDProjectCategoryView StatusLast Update
0016376mantisbtcustomizationpublic2016-12-30 04:33
Reporteratrol Assigned Todregad  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Product Version1.2.13 
Target Version1.2.16Fixed in Version1.2.16 
Summary0016376: Not able to change status without having update issue rights
Description

It was possible to change status without having update issue rights in earlier versions of MantisBT <1.2.13.
The changed behavior has been introduced in fix for 0015258 [1]

There where users in forum that noticed the regression or need the previous functionality for their workflow [2][3]

Changing status is probably updating a bug but it seems that update_bug_threshold is more meant as a threshold which is considered if there is no other threshold which is more specific.

Furthermore if changing status is considered to be an update we would have also to consider "assign to" as an update.
Access to "Assign to" is not dependent on update_bug_threshold but only handle_bug_threshold.

My conclusion until now: Access to "Change status" should not be dependent on update_bug_threshold but update_bug_status_threshold

Changing
<pre>
if( !access_has_bug_level( config_get( 'update_bug_threshold' ), $p_bug->id ) ) {
</pre>
to
<pre>
if( !access_has_bug_level( config_get( 'update_bug_status_threshold' ), $p_bug->id ) ) {
</pre>
in file core/html_api.php function html_button_bug_change_status should be enough to fix the issue without introducing a regression for 0015258

[1] https://github.com/mantisbt/mantisbt/commit/c88137343b0f6d47613ed7fefc5d1277b901b778#L0R1390
[2] http://www.mantisbt.org/forums/viewtopic.php?f=3&amp;t=21642
[3] http://www.mantisbt.org/forums/viewtopic.php?f=3&amp;t=21676

TagsNo tags attached.

Relationships

related to 0015258 closeddregad CVE-2013-1811 Reporter can change issue status to 'new' 
related to 0016625 closeddregad Allow reporter to close does not seem to work 
related to 0022093 closedvboctor Reporter canĀ“t change status of a bug 

Activities

dregad

dregad

2013-09-14 04:24

developer   ~0038041

You're absolutely right, it's a mistake from my part to pick the wrong config setting in the fix for 0015258, I should indeed have used update_bug_status_threshold and not update_bug_threshold.

I'll do some testing to ensure doing this does not reintroduce the original security issue whereby a reporter could change an issue status to new (if update_bug_status_threshold = REPORTER in this case), or other regressions.

dregad

dregad

2013-09-14 04:40

developer   ~0038042

OK, so with this change a reporter can update the status to anything allowed by the workflow, and considering that it is obviously required for a reporter to be able to report issues (!), the only way to remove the possibility to change status back to NEW, is to uncheck it as available 'Next status'.

This is not necessary however if the issue is in RESOLVED or CLOSED status as the Change Status list and button will not be displayed in this case.

This does introduce potential inconsistencies, with default settings: a reporter can change an issue's status to ASSIGNED, RESOLVED or CLOSED, but since they are not able to assign an issue (update_bug_assign_threshold) the handler will not be set.

I guess that's OK since we should expect the admin to set its workflow properly (i.e. set minimum access level for ASSIGNED and above).

Related Changesets

MantisBT: master-1.2.x e074efde

2013-09-14 04:38:06

dregad

Details Diff
Use correct threshold for display of Change status list+button

Fix for issue 0015258 introduced a check for 'update_bug_threshold' to
prevent unauthorized users from changing issue status.

This was not the correct config setting to use, the right one is
'update_bug_status_threshold'.

Fixes 0016376
Affected Issues
0015258, 0016376
mod - core/html_api.php Diff File

MantisBT: master d5da1d24

2013-09-14 04:38:06

dregad

Details Diff
Use correct threshold for display of Change status list+button

Fix for issue 0015258 introduced a check for 'update_bug_threshold' to
prevent unauthorized users from changing issue status.

This was not the correct config setting to use, the right one is
'update_bug_status_threshold'.

Fixes 0016376
Affected Issues
0015258, 0016376
mod - core/html_api.php Diff File

Issue History

Date Modified Username Field Change
2013-09-13 15:03 atrol New Issue
2013-09-13 15:04 atrol Relationship added related to 0015258
2013-09-14 04:24 dregad Note Added: 0038041
2013-09-14 04:24 dregad Assigned To => dregad
2013-09-14 04:24 dregad Status new => acknowledged
2013-09-14 04:40 dregad Note Added: 0038042
2013-09-14 04:42 dregad Status acknowledged => assigned
2013-09-14 04:42 dregad Changeset attached => MantisBT master-1.2.x e074efde
2013-09-14 04:42 dregad Status assigned => resolved
2013-09-14 04:42 dregad Resolution open => fixed
2013-09-14 04:42 dregad Fixed in Version => 1.2.16
2013-09-14 04:42 dregad Changeset attached => MantisBT master d5da1d24
2013-09-14 04:43 dregad Target Version => 1.2.16
2013-11-19 04:21 dregad Relationship added related to 0016625
2014-02-07 18:24 dregad Status resolved => closed
2016-12-30 04:33 atrol Relationship added related to 0022093