#$@%#$%!

Ngiler SH3LL 360
: / var / softaculous / mantis /

Information Server
MySQL : OFF Perl : OFF CURL : ON WGET : OFF PKEXEC : OFF

Directive	Local Value
IP Address	63.250.38.10
System	Linux premium90.web-hosting.com 4.18.0-553.44.1.lve.el8.x86_64 #1 SMP Thu Mar 13 14:29:12 UTC 2025 x86_64
User	likhxapw
PHP Version	8.3.30
Software	LiteSpeed
Doc root	Writable

Edit File : changelog.txt \| Size : 10.50 KB
mantisbt - 2.28.1 Released 2026-03-16 Maintenance and security release addressing a critical vulnerability affecting the SOAP API on MySQL (CVE-2026-30849, thanks to Alexander Philiotis of SynerComm) and two HTML injection / XSS issues with tag names (CVE not yet assigned, credits to Vishal Shukla). The release also fixes a few bugs including regression issues introduced in 2.28.0. 0036810: [bugtracker] Accessing bug_report_page.php (and other pages) anonymously results in blank page (dregad) 0036971: [security] Stored HTML Injection / XSS in Tag Delete Confirmation via Unescaped Tag Name (dregad) 0036973: [security] Stored HTML Injection / XSS in my_view_page.php Timeline via Unescaped Historic Tag Name (dregad) 0036818: [api soap] Call to undefined function date_timestamp_to_iso8601() (dregad) 0036855: [bugtracker] Application error on bug_relationship_graph.php page (community) 0036860: [tools] Update PHPUnit to 9.6.34 (dregad) 0036823: [email] Update PHPMailer to 7.0.2 (dregad) 0036972: [localization] Invalid use of {{GENDER:*}} tag in French language strings (dregad) mantisbt - 2.28.0 Released 2025-12-29 Maintenance release including nearly 80 enhancements and bug fixes. Highlights: compatibility with PHP 8.4 and 8.5, improved documentation including an OpenAPI Description for the REST API, better Tags management, restored included pages functionality and many others. 0026740: [plug-ins] Improve documentation for plugin_require_api() and plugin_event_hook() (dregad) 0035227: [markdown] MantisBT is not compatible with Parsedown 1.8 (community) 0035258: [other] Use of PHPUnit::toString() sometimes causes errors in tests (dregad) 0034960: [api soap] SOAP: Update WSDL viewer to version 3.1.03 (dregad) 0035038: [ui] Text on the relationship and workflow graphs are rendered cropped (community) 0035082: [plug-ins] Allow plugin_file_path() to return the files directory and use the current plugin by default (community) 0035230: [code cleanup] Use generic language strings for Tags management pages (dregad) 0035070: [plug-ins] Unable to retrieve values of arbitrary fields from LDAP. (dregad) 0035229: [tagging] Allow direct editing of tags from Manage Tags page (dregad) 0005271: [other] Support NoFollow hyperlinks for external urls (community) 0035228: [tagging] View and Update tag pages are not integrated in the Manage Tags menu (dregad) 0035223: [other] MantisBT tests are not compatible with PHPUnit 11.5 (community) 0035208: [plug-ins] Improve error handling for invalid plugins (dregad) 0035210: [ui] Incorrect handling of relative URLs in helper_get_root_domain() function and caller one (dregad) 0035212: [tools] GetLinkAttributesTest does not reset html_make_links config after tests (dregad) 0035211: [bugtracker] Core should allow detecting whether a config is set in the database (dregad) 0035219: [tagging] Number of related tags is no longer limited (dregad) 0034876: [bugtracker] When moving issues, it should not be possible to select the current project as target (dregad) 0034848: [reports] MantisGraph: view all data values when hovering over line (dregad) 0034847: [reports] Upgrade chart.js library to 3.9.1 (dregad) 0034824: [performance] Multiple execution of the same query with Profile API functions (dregad) 0006803: [bugtracker] Allow adding a note when moving an Issue to another project (dregad) 0010027: [tagging] Switching project on the Update Tag page gives APPLICATION ERROR 200 (dregad) 0022607: [tagging] Clean up unused tags (dregad) 0035259: [code cleanup] Add namespaces to PHPUnit test suite (dregad) 0035260: [administration] Project names should be trimmed before project creation or update (vboctor) 0035425: [ui] Inconsistent display in navbar user menu (dregad) 0035439: [performance] Multiple loads of plugins on the manage_plugin_page (community) 0035525: [bugtracker] gpc_get_int() should not remove spaces in the middle of the string (dregad) 0035551: [administration] Improve output of log events when $g_log_destination = 'page' (dregad) 0035402: [html] Footer has the wrong size (community) 0035544: [db postgresql] Attempt to update the category in the “Edit Project Category” form results in an error (dregad) 0021113: [plug-ins] EVENT_LAYOUT_PAGE_HEADER no longer available (community) 0022098: [customization] Setting bottom_include_page does not include specified file (community) 0035568: [code cleanup] Calling layout_page_header() without parameters throws deprecation warning on PHP 8.1 (dregad) 0035561: [ui] "Access Denied" page has no layout for anonymous account (community) 0036438: [plug-ins] MantisCoreFormatting: Error when saving configuration (atrol) 0035552: [ui] Inline error messages are sometimes displayed behind the navbar (dregad) 0035583: [bugtracker] Delayed inline errors are not printed on login page (dregad) 0036614: [code cleanup] PHP 8.5 compatibility (dregad) 0036618: [db schema] Update ADOdb to 5.22.11 (dregad) 0036617: [code cleanup] PHP 8.5: Increment on non-numeric string is deprecated (dregad) 0036616: [code cleanup] PHP 8.5: case followed by semicolon deprecations (dregad) 0036615: [code cleanup] PHP 8.5: non-canonical cast deprecations (dregad) 0035647: [documentation] Outdated build status in README.md (atrol) 0035562: [ui] If user is anonymous, page footer overlaps with error message (community) 0035587: [administration] Access Denied page's Login button has Invalid URL when triggered from Admin pages (dregad) 0035874: [email] Update PHPMailer to 7.0.1 (dregad) 0036621: [plug-ins] Support moderation via plugins (vboctor) 0035646: [documentation] Wrong code example in Admin Guide (atrol) 0036624: [email] Changing email address is no longer possible (atrol) 0035645: [ui] Some widgets are not collapsible (community) 0035644: [ui] Extra page load due to dropzone <img> stub tag (community) 0036786: [email] Calling email API functions from CLI triggers PHP warning (dregad) 0034649: [ui] Reorder group update actions in selection list (atrol) 0036765: [plug-ins] The plugin_get_current() function returns an incorrect value when executed from MantisPlugin::schema() (dregad) 0034928: [bugtracker] Date conversion fails using a non-US date format in VersionUpdateCommand.php (dregad) 0034938: [other] Update htmlpurifier to 4.19.0 (dregad) 0035756: [api rest] Update Guzzle to 7.10.0 (dregad) 0035540: [installation] A clean installation ends with Internal Server Error with no message/detail given (dregad) 0035207: [ui] Early inline warnings mess up with page layout (dregad) 0036510: [ui] Increase spacing before lock icon on relationship to private issue (dregad) 0035503: [html] The MantisBT web interface must pass HTML validation (part 2) (community) 0035288: [email] Support custom email sending providers (vboctor) 0036278: [email] Incorrect relationship type in email notifications (vboctor) 0035424: [code cleanup] Use new string_build_query() API function (community) 0035626: [ui] Main menu custom option with non-http absolute URL displayed incorrectly (community) 0006159: [documentation] Sticky Issues: document usage (dregad) 0014508: [documentation] Document usage of "Stick" Button in View Issue Details page (dregad) 0022250: [ui] Remove useless spacing in the footer (community) 0034823: [api rest] Create an OpenAPI Description for REST API (vboctor) 0035216: [code cleanup] PHP 8.4 compatibility (dregad) 0035217: [markdown] PHP 8.4 deprecation warnings in Parsedown 1.7.4 (dregad) 0035214: [code cleanup] PHP 8.4: fputcsv() empty $escape parameter is deprecated (dregad) 0035213: [code cleanup] PHP 8.4: E_STRICT is deprecated (dregad) 0035284: [api rest] Allow REST API to run on PHP 8.4 ignoring E_DEPRECATED notices (dregad) 0035215: [code cleanup] PHP 8.4: Implicitly nullable parameter types are deprecated (dregad) 0035283: [api soap] PHP 8.4: SOAP API throws SoapFault: Internal Service Error (dregad) mantisbt - 2.27.3 Released 2025-11-03 Hotfix release addressing a couple of regression issues affecting Admin Checks introduced by 2.27.2. 0036619: [administration] Most Admin Checks are disabled in 2.27.2 (dregad) 0036620: [administration] PHP Fatal error in Admin Checks of custom fields (atrol) mantisbt - 2.27.2 Released 2025-11-01 Maintenance and security release addressing 4 vulnerabilities, fixing several bugs and including a few minor improvements, Many thanks to Harry Sintonen / Reversec for CVE-2025-47776 (GHSA-4v8w-gg5j-ph37), Mazen Mahmoud for CVE-2025-46556 (GHSA-r3jf-hm7q-qfw5), Chaitanya Reddy for CVE-2025-55155 (GHSA-q747-c74m-69pr) and d3vpoo1 for CVE-2025-62520 (GHSA-g582-8vwr-68h2). 0035906: [db schema] Update ADOdb to 5.22.10 (dregad) 0036540: [bugtracker] Introduce a maximum PHP version (dregad) 0035915: [administration] Updating a global config yields incorrect error message (dregad) 0035893: [security] CVE-2025-46556: Denial-of-Service (DoS) via Excessive Note Length (dregad) 0036164: [administration] Impossible to delete a global config defined in the database (dregad) 0035668: [api rest] can't change issue category to "no category" via rest api (dregad) 0036269: [bugtracker] Collapsed status for "Users monitoring" section is not persisted (dregad) 0036265: [feature] Search with collapsed filter section expands it (dregad) 0036263: [administration] Error editing categories with PostgreSQL: APPLICATION ERROR 401 (dregad) 0036515: [administration] Hardcoded role instead of config in access level check on Manage Columns page (dregad) 0036542: [bugtracker] When editing a bugnote, a newline is appended to the text (dregad) 0036512: [other] Access Denied page returns HTTP status 200 (dregad) 0035854: [tools] PHPUnit assertObjectHasAttribute() method is deprecated (dregad) 0035853: [tools] PHPUnit tests RestFiltersTest fail when anonymous access is disabled (dregad) 0035852: [api rest] REST API GET /filters throws deprecation warning on PHP 8.1 (dregad) 0036503: [bugtracker] Ability to change the default project of a user (dregad) 0036257: [bugtracker] Deleted notes not showing in bug history (dregad) 0036535: [code cleanup] Custom Field admin checks refactoring (dregad) 0021675: [ui] Incorrect positioning of "View Issue Details" when recalled from "Direct link to note" (dregad) 0035967: [authentication] CVE-2025-47776: Authentication bypass for some passwords due to PHP type juggling (dregad) 0036005: [security] CVE-2025-55155: Lack of verification when changing a user's email address (dregad) 0036502: [security] CVE-2025-62520: Ability to copy private project configurations (Columns) (atrol) Back

Edit File : changelog.txt | Size : 10.50 KB

mantisbt - 2.28.1 Released 2026-03-16

Maintenance and security release addressing a critical vulnerability affecting the SOAP API on MySQL (CVE-2026-30849, thanks to Alexander Philiotis of SynerComm) and two HTML injection / XSS issues with tag names (CVE not yet assigned, credits to Vishal Shukla). The release also fixes a few bugs including regression issues introduced in 2.28.0.

0036810: [bugtracker] Accessing bug_report_page.php (and other pages) anonymously results in blank page (dregad)
    0036971: [security] Stored HTML Injection / XSS in Tag Delete Confirmation via Unescaped Tag Name (dregad)
    0036973: [security] Stored HTML Injection / XSS in my_view_page.php Timeline via Unescaped Historic Tag Name (dregad)
    0036818: [api soap] Call to undefined function date_timestamp_to_iso8601() (dregad)
    0036855: [bugtracker] Application error on bug_relationship_graph.php page (community)
    0036860: [tools] Update PHPUnit to 9.6.34 (dregad)
    0036823: [email] Update PHPMailer to 7.0.2 (dregad)
    0036972: [localization] Invalid use of {{GENDER:*}} tag in French language strings (dregad)
	
mantisbt - 2.28.0 Released 2025-12-29

Maintenance release including nearly 80 enhancements and bug fixes. Highlights: compatibility with PHP 8.4 and 8.5, improved documentation including an OpenAPI Description for the REST API, better Tags management, restored included pages functionality and many others.

0026740: [plug-ins] Improve documentation for plugin_require_api() and plugin_event_hook() (dregad)
	0035227: [markdown] MantisBT is not compatible with Parsedown 1.8 (community)
	0035258: [other] Use of PHPUnit::toString() sometimes causes errors in tests (dregad)
	0034960: [api soap] SOAP: Update WSDL viewer to version 3.1.03 (dregad)
	0035038: [ui] Text on the relationship and workflow graphs are rendered cropped (community)
	0035082: [plug-ins] Allow plugin_file_path() to return the files directory and use the current plugin by default (community)
	0035230: [code cleanup] Use generic language strings for Tags management pages (dregad)
	0035070: [plug-ins] Unable to retrieve values of arbitrary fields from LDAP. (dregad)
	0035229: [tagging] Allow direct editing of tags from Manage Tags page (dregad)
	0005271: [other] Support NoFollow hyperlinks for external urls (community)
	0035228: [tagging] View and Update tag pages are not integrated in the Manage Tags menu (dregad)
	0035223: [other] MantisBT tests are not compatible with PHPUnit 11.5 (community)
	0035208: [plug-ins] Improve error handling for invalid plugins (dregad)
	0035210: [ui] Incorrect handling of relative URLs in helper_get_root_domain() function and caller one (dregad)
	0035212: [tools] GetLinkAttributesTest does not reset html_make_links config after tests (dregad)
	0035211: [bugtracker] Core should allow detecting whether a config is set in the database (dregad)
	0035219: [tagging] Number of related tags is no longer limited (dregad)
	0034876: [bugtracker] When moving issues, it should not be possible to select the current project as target (dregad)
	0034848: [reports] MantisGraph: view all data values when hovering over line (dregad)
	0034847: [reports] Upgrade chart.js library to 3.9.1 (dregad)
	0034824: [performance] Multiple execution of the same query with Profile API functions (dregad)
	0006803: [bugtracker] Allow adding a note when moving an Issue to another project (dregad)
	0010027: [tagging] Switching project on the Update Tag page gives APPLICATION ERROR 200 (dregad)
	0022607: [tagging] Clean up unused tags (dregad)
	0035259: [code cleanup] Add namespaces to PHPUnit test suite (dregad)
	0035260: [administration] Project names should be trimmed before project creation or update (vboctor)
	0035425: [ui] Inconsistent display in navbar user menu (dregad)
	0035439: [performance] Multiple loads of plugins on the manage_plugin_page (community)
	0035525: [bugtracker] gpc_get_int() should not remove spaces in the middle of the string (dregad)
	0035551: [administration] Improve output of log events when $g_log_destination = 'page' (dregad)
	0035402: [html] Footer has the wrong size (community)
	0035544: [db postgresql] Attempt to update the category in the “Edit Project Category” form results in an error (dregad)
	0021113: [plug-ins] EVENT_LAYOUT_PAGE_HEADER no longer available (community)
	0022098: [customization] Setting bottom_include_page does not include specified file (community)
	0035568: [code cleanup] Calling layout_page_header() without parameters throws deprecation warning on PHP 8.1 (dregad)
	0035561: [ui] "Access Denied" page has no layout for anonymous account (community)
	0036438: [plug-ins] MantisCoreFormatting: Error when saving configuration (atrol)
	0035552: [ui] Inline error messages are sometimes displayed behind the navbar (dregad)
	0035583: [bugtracker] Delayed inline errors are not printed on login page (dregad)
	0036614: [code cleanup] PHP 8.5 compatibility (dregad)
	0036618: [db schema] Update ADOdb to 5.22.11 (dregad)
	0036617: [code cleanup] PHP 8.5: Increment on non-numeric string is deprecated (dregad)
	0036616: [code cleanup] PHP 8.5: case followed by semicolon deprecations (dregad)
	0036615: [code cleanup] PHP 8.5: non-canonical cast deprecations (dregad)
	0035647: [documentation] Outdated build status in README.md (atrol)
	0035562: [ui] If user is anonymous, page footer overlaps with error message (community)
	0035587: [administration] Access Denied page's Login button has Invalid URL when triggered from Admin pages (dregad)
	0035874: [email] Update PHPMailer to 7.0.1 (dregad)
	0036621: [plug-ins] Support moderation via plugins (vboctor)
	0035646: [documentation] Wrong code example in Admin Guide (atrol)
	0036624: [email] Changing email address is no longer possible (atrol)
	0035645: [ui] Some widgets are not collapsible (community)
	0035644: [ui] Extra page load due to dropzone <img> stub tag (community)
	0036786: [email] Calling email API functions from CLI triggers PHP warning (dregad)
	0034649: [ui] Reorder group update actions in selection list (atrol)
	0036765: [plug-ins] The plugin_get_current() function returns an incorrect value when executed from MantisPlugin::schema() (dregad)
	0034928: [bugtracker] Date conversion fails using a non-US date format in VersionUpdateCommand.php (dregad)
	0034938: [other] Update htmlpurifier to 4.19.0 (dregad)
	0035756: [api rest] Update Guzzle to 7.10.0 (dregad)
	0035540: [installation] A clean installation ends with Internal Server Error with no message/detail given (dregad)
	0035207: [ui] Early inline warnings mess up with page layout (dregad)
	0036510: [ui] Increase spacing before lock icon on relationship to private issue (dregad)
	0035503: [html] The MantisBT web interface must pass HTML validation (part 2) (community)
	0035288: [email] Support custom email sending providers (vboctor)
	0036278: [email] Incorrect relationship type in email notifications (vboctor)
	0035424: [code cleanup] Use new string_build_query() API function (community)
	0035626: [ui] Main menu custom option with non-http absolute URL displayed incorrectly (community)
	0006159: [documentation] Sticky Issues: document usage (dregad)
	0014508: [documentation] Document usage of "Stick" Button in View Issue Details page (dregad)
	0022250: [ui] Remove useless spacing in the footer (community)
	0034823: [api rest] Create an OpenAPI Description for REST API (vboctor)
	0035216: [code cleanup] PHP 8.4 compatibility (dregad)
	0035217: [markdown] PHP 8.4 deprecation warnings in Parsedown 1.7.4 (dregad)
	0035214: [code cleanup] PHP 8.4: fputcsv() empty $escape parameter is deprecated (dregad)
	0035213: [code cleanup] PHP 8.4: E_STRICT is deprecated (dregad)
	0035284: [api rest] Allow REST API to run on PHP 8.4 ignoring E_DEPRECATED notices (dregad)
	0035215: [code cleanup] PHP 8.4: Implicitly nullable parameter types are deprecated (dregad)
	0035283: [api soap] PHP 8.4: SOAP API throws SoapFault: Internal Service Error (dregad)

mantisbt - 2.27.3 Released 2025-11-03

Hotfix release addressing a couple of regression issues affecting Admin Checks introduced by 2.27.2.

0036619: [administration] Most Admin Checks are disabled in 2.27.2 (dregad)
    0036620: [administration] PHP Fatal error in Admin Checks of custom fields (atrol)
	
mantisbt - 2.27.2 Released 2025-11-01

Maintenance and security release addressing 4 vulnerabilities, fixing several bugs and including a few minor improvements, Many thanks to Harry Sintonen / Reversec for CVE-2025-47776 (GHSA-4v8w-gg5j-ph37), Mazen Mahmoud for CVE-2025-46556 (GHSA-r3jf-hm7q-qfw5), Chaitanya Reddy for CVE-2025-55155 (GHSA-q747-c74m-69pr) and d3vpoo1 for CVE-2025-62520 (GHSA-g582-8vwr-68h2).

0035906: [db schema] Update ADOdb to 5.22.10 (dregad)
    0036540: [bugtracker] Introduce a maximum PHP version (dregad)
    0035915: [administration] Updating a global config yields incorrect error message (dregad)
    0035893: [security] CVE-2025-46556: Denial-of-Service (DoS) via Excessive Note Length (dregad)
    0036164: [administration] Impossible to delete a global config defined in the database (dregad)
    0035668: [api rest] can't change issue category to "no category" via rest api (dregad)
    0036269: [bugtracker] Collapsed status for "Users monitoring" section is not persisted (dregad)
    0036265: [feature] Search with collapsed filter section expands it (dregad)
    0036263: [administration] Error editing categories with PostgreSQL: APPLICATION ERROR 401 (dregad)
    0036515: [administration] Hardcoded role instead of config in access level check on Manage Columns page (dregad)
    0036542: [bugtracker] When editing a bugnote, a newline is appended to the text (dregad)
    0036512: [other] Access Denied page returns HTTP status 200 (dregad)
    0035854: [tools] PHPUnit assertObjectHasAttribute() method is deprecated (dregad)
    0035853: [tools] PHPUnit tests RestFiltersTest fail when anonymous access is disabled (dregad)
    0035852: [api rest] REST API GET /filters throws deprecation warning on PHP 8.1 (dregad)
    0036503: [bugtracker] Ability to change the default project of a user (dregad)
    0036257: [bugtracker] Deleted notes not showing in bug history (dregad)
    0036535: [code cleanup] Custom Field admin checks refactoring (dregad)
    0021675: [ui] Incorrect positioning of "View Issue Details" when recalled from "Direct link to note" (dregad)
    0035967: [authentication] CVE-2025-47776: Authentication bypass for some passwords due to PHP type juggling (dregad)
    0036005: [security] CVE-2025-55155: Lack of verification when changing a user's email address (dregad)
    0036502: [security] CVE-2025-62520: Ability to copy private project configurations (Columns) (atrol)

Back