0037320: Cannot submit bug when selecting any product version - MantisBT

View Issue Details

IDProjectCategoryView StatusDate SubmittedLast Update
0037320mantisbtbugtrackerpublic2026年07月21日 12:262026年07月21日 18:33
Reportersyzop Assigned Tocommunity  
PrioritynormalSeveritymajorReproducibilityalways
Status resolvedResolutionfixed 
Product Version2.28.4 
Target Version2.29.0Fixed in Version2.29.0 
Summary0037320: Cannot submit bug when selecting any product version
Description

Since mantisBT 2.28.4, when trying to submit a bug, when a user selects ANY Product Version mantis will reject the bug saying invalid version. I already missed several bug reports due to this.

Oh and this issue is also present on this/your very bugtracker. I just had to retype my whole bug report because of it :-)

If you have like DEVELOPER level then the bug does not occur. If you select NO product version then the bug does not occur.

The fix in "Additional Information" or a workaround is setting: $g_report_issues_for_unreleased_versions_threshold = REPORTER;

Thanks for fixing this. We are happy to use mantis since 2002 :)

Additional Information

The fix is changing core/commands/IssueAddCommand.php

From:

if( $t_version_id != 0 ) {
 if( !access_has_project_level( config_get( 'report_issues_for_unreleased_versions_threshold' ) ) ) {
 throw new ClientException(
 'User not allowed to assign unreleased versions',
 ERROR_INVALID_FIELD_VALUE,
 ['version']
 );
 }
 $this->issue->version = version_get_field( $t_version_id, 'version' );
}

To something like:

if( $t_version_id != 0 ) {
 if( !version_is_released( $t_version_id ) && !access_has_project_level( config_get( 'report_issues_for_unreleased_versions_threshold' ) ) ) {
 throw new ClientException(
 'User not allowed to assign unreleased versions',
 ERROR_INVALID_FIELD_VALUE,
 ['version']
 );
 }
 $this->issue->version = version_get_field( $t_version_id, 'version' );
}

EDIT (dregad): add markdown for proper code indentation

Tagspatch

Relationships

related to  0037065 closed community   CVE-2026-52882: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters 

Activities

dregad

2026年07月21日 12:41

developer   ~0071320

Thanks for the report and proposed fix @syzop , sorry about the inconvenience.

Are you saying the problem was introduced in 2.28.4 (i.e. not present in 2.28.3) ? If so, then it's likely a regression introduced by MantisBT master-2.28 0ac87c39 (see 0037065). I cannot analyze right now, will check later on.

Would you be able/willing to submit a pull request with the proposed patch ?

We are happy to use mantis since 2002 :)

Wow, early customer :-) thanks for your continued trust !

syzop

2026年07月21日 12:53

reporter   ~0071321

Yes exactly, the bug was introduced in 2.28.4, when the code that checks for report_issues_for_unreleased_versions_threshold was added. I'll do a PR.

And yeah we're an old project/user: https://bugs.unrealircd.org/view.php?id=8 (date submitted.. 2001年12月28日 19:39) :-)

syzop

2026年07月21日 13:08

reporter   ~0071322

Done, created as https://github.com/mantisbt/mantisbt/pull/2251

dregad

2026年07月21日 18:25

developer   ~0071323

I confirm the regression, and that your patch fixes it. Many thanks !

Related Changesets

MantisBT: master 4cfa980d

2026年07月21日 18:33

syzop

Committer: community


Details Diff Fix unable to submit issue when a released version is selected

Previous fix 0037065 in 2.28.4 [1] added a version check but this
has a regression: it causes us to refuse a bug report if any
product version is selected by a reporter.

Fixes 0037320, PR https://github.com/mantisbt/mantisbt/pull/2251

[1]: commit 0ac87c39fb4746a2f8c276730fa689baf47ba8ba Affected Issues
0037065, 0037320
mod - core/commands/IssueAddCommand.php Diff File
Powered by MantisBT 2.29.0-dev-master-e4ff7ef87
Copyright © 2000 - 2026 MantisBT Team
Contact administrator for assistance
Page execution time: 0.2199 seconds    

AltStyle によって変換されたページ (->オリジナル) /