0021203: option auto_set_status_to_assigned can change status even if not allowed by workflow - MantisBT - Signup temporarily disabled due to spam

ID	Project	Category	View Status	Date Submitted	Last Update

0021203	mantisbt	bugtracker	public	2016-07-05 17:49	2017-04-10 07:39

Reporter	cproensa	Assigned To	cproensa
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	closed	Resolution	fixed
Product Version	1.3.0-rc.2
Target Version	1.3.1	Fixed in Version	1.3.1

Summary	0021203: option auto_set_status_to_assigned can change status even if not allowed by workflow
Description	The option "auto_set_status_to_assigned" does not check if the transition into target assign status is allowed by workflow configuration
Tags	No tags attached.

cproensa 2016-07-05 18:22 developer ~0053517	The workflow can actually be bypassed by bug_update_page.php: change "assigned to", and the status is changed even if now allowed by workflow configuration

cproensa 2016-07-05 18:37 developer ~0053518	Additionally: When "assigned status" is not an allowed transition in workflow configuration, the bug_actiongroup "assign" cannot be performed, resulting in the error: "This issue cannot be changed to the requested status" should the expected behaviour be assign the issues without status change?

cproensa 2016-07-05 20:23 developer ~0053519	PR: https://github.com/mantisbt/mantisbt/pull/811

MantisBT: master 5de0133c 2016-07-05 14:01 cproensa Committer: vboctor Details Diff	move "auto_set_status_to_assigned" logic into bug_api Create a bug api function to evaluate the resulting status after an assignment action. This function account for the option "auto_set_status_to_assigned", current handler and status, and requested new handler and status. The behaviour of assignments, when this option is enabled, is slightly modified: Previously, inconcistent logic allowed to transition a bug into assigned status by changing handler user, even if the transition is not allowed by workflow configuration. Additionally, the assign action was not available to the user if the assigned status is not reachable by workflow, even when the assign action would not result in a status change. Now, the assign action is always available (if allowed by permissions), and the status change is performed only if the conditions are met, otherwise, the handler change is always performed. The conditions needed for automatic change to 'bug_assigned_status' are: - current handler is empty - new handler is not empty - status is not already part of the bug modification - current status is lower than 'bug_assigned_status' - 'bug_assigned_status' is reachable by workflow Fixes 0021203		Affected Issues 0021203
	mod - bug_actiongroup.php		Diff File
	mod - bug_update.php		Diff File
	mod - core/bug_api.php		Diff File
	mod - core/bug_group_action_api.php		Diff File
	mod - core/html_api.php		Diff File
MantisBT: master-1.3.x 62cb79c5 2016-07-05 14:01 cproensa Committer: vboctor Details Diff	move "auto_set_status_to_assigned" logic into bug_api Create a bug api function to evaluate the resulting status after an assignment action. This function account for the option "auto_set_status_to_assigned", current handler and status, and requested new handler and status. The behaviour of assignments, when this option is enabled, is slightly modified: Previously, inconcistent logic allowed to transition a bug into assigned status by changing handler user, even if the transition is not allowed by workflow configuration. Additionally, the assign action was not available to the user if the assigned status is not reachable by workflow, even when the assign action would not result in a status change. Now, the assign action is always available (if allowed by permissions), and the status change is performed only if the conditions are met, otherwise, the handler change is always performed. The conditions needed for automatic change to 'bug_assigned_status' are: - current handler is empty - new handler is not empty - status is not already part of the bug modification - current status is lower than 'bug_assigned_status' - 'bug_assigned_status' is reachable by workflow Fixes 0021203		Affected Issues 0021203
	mod - bug_actiongroup.php		Diff File
	mod - bug_update.php		Diff File
	mod - core/bug_api.php		Diff File
	mod - core/bug_group_action_api.php		Diff File
	mod - core/html_api.php		Diff File