Re: [mantisbt-dev] Review: sql injection fixes

[Paul R. <pa...@ma...>]

the change to the event handling is at
https://github.com/grangeway/mantisbt/tree/event-fix for review

The sql injection changes are at
https://github.com/grangeway/mantisbt/tree/sqlinjection-fixes


On Fri, Jan 17, 2014 at 9:10 PM, Paul Richards <pa...@ma...> wrote:

> Give me a minute and i'll push them as 3 seperate branches
>
> In addition, Issue 0016595: When running via php-fpm you cannot create a
> ticket on our tracker.
>
> I think that can be resolved directing user to forums for help as running
> mantis via php-fpm works as a supported scenario. I suspect the user has a
> proxy or similar in the middle causing the issue which is probably best
> diagnosed via the forum.
>
>
> On Fri, Jan 17, 2014 at 9:08 PM, Robert Munteanu <
> rob...@gm...> wrote:
>
>> I'll cherry-pick and test you commit locally over this weekend.
>>
>> Robert
>>
>> On Fri, Jan 17, 2014 at 10:57 PM, Paul Richards <pa...@ma...>
>> wrote:
>> > hmm, wtf? - github's web interface seems bad ;/
>> >
>> > "Git Wise" - it's our current master + 3 commits
>> >
>> > 1) nginx changes requested by atrol
>> > 2) remove a event only in master not in current releases, that probably
>> > needs dropping after we update email/notifciation api
>> > 3) potential security fixes
>> >
>> >
>> >
>> >
>> > On Fri, Jan 17, 2014 at 8:54 PM, Robert Munteanu <
>> rob...@gm...>
>> > wrote:
>> >>
>> >> I can only compare them master-2.0.x using github - "This branch is
>> >> 1134 commits ahead and 310 commits behind master-2.0.x ". I'll try and
>> >> coax github into comparing it to master somehow.
>> >>
>> >> On Fri, Jan 17, 2014 at 10:52 PM, Paul Richards <pa...@ma...>
>> >> wrote:
>> >> > The fixes should be against master?
>> >> >
>> >> > Paul
>> >> >
>> >> >
>> >> >
>> >> > On Fri, Jan 17, 2014 at 8:50 PM, Robert Munteanu
>> >> > <rob...@gm...>
>> >> > wrote:
>> >> >>
>> >> >> Thanks for taking this up. Any chance of making the fixes against
>> >> >> master-1.2.x or master?
>> >> >> It would make it easier ( for me ) to review and test.
>> >> >>
>> >> >> Robert
>> >> >>
>> >> >> On Fri, Jan 17, 2014 at 10:32 PM, Paul Richards <
>> pa...@ma...>
>> >> >> wrote:
>> >> >> > Hello,
>> >> >> >
>> >> >> > I've pushed a new branch for review as requested.
>> >> >> >
>> >> >> > This includes fixes for sql injection vulnerabilities within
>> mantis:
>> >> >> >
>> >> >> > https://github.com/grangeway/mantisbt/tree/sqlinjectionfixes
>> >> >> >
>> >> >> > At least one of which has been privately reported.
>> >> >> >
>> >> >> > Paul
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >
>> ------------------------------------------------------------------------------
>> >> >> > CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> >> >> > Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> >> >> > Critical Workloads, Development Environments & Everything In
>> Between.
>> >> >> > Get a Quote or Start a Free Trial Today.
>> >> >> >
>> >> >> >
>> >> >> >
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> >> >> > _______________________________________________
>> >> >> > mantisbt-dev mailing list
>> >> >> > man...@li...
>> >> >> > https://lists.sourceforge.net/lists/listinfo/mantisbt-dev
>> >> >> >
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> http://robert.muntea.nu/
>> >> >>
>> >> >>
>> >> >>
>> >> >>
>> ------------------------------------------------------------------------------
>> >> >> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> >> >> Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> >> >> Critical Workloads, Development Environments & Everything In
>> Between.
>> >> >> Get a Quote or Start a Free Trial Today.
>> >> >>
>> >> >>
>> >> >>
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> >> >> _______________________________________________
>> >> >> mantisbt-dev mailing list
>> >> >> man...@li...
>> >> >> https://lists.sourceforge.net/lists/listinfo/mantisbt-dev
>> >> >
>> >> >
>> >> >
>> >> >
>> >> >
>> ------------------------------------------------------------------------------
>> >> > CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> >> > Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> >> > Critical Workloads, Development Environments & Everything In Between.
>> >> > Get a Quote or Start a Free Trial Today.
>> >> >
>> >> >
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> >> > _______________________________________________
>> >> > mantisbt-dev mailing list
>> >> > man...@li...
>> >> > https://lists.sourceforge.net/lists/listinfo/mantisbt-dev
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >> http://robert.muntea.nu/
>> >>
>> >>
>> >>
>> ------------------------------------------------------------------------------
>> >> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> >> Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> >> Critical Workloads, Development Environments & Everything In Between.
>> >> Get a Quote or Start a Free Trial Today.
>> >>
>> >>
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> >> _______________________________________________
>> >> mantisbt-dev mailing list
>> >> man...@li...
>> >> https://lists.sourceforge.net/lists/listinfo/mantisbt-dev
>> >
>> >
>> >
>> >
>> ------------------------------------------------------------------------------
>> > CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> > Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> > Critical Workloads, Development Environments & Everything In Between.
>> > Get a Quote or Start a Free Trial Today.
>> >
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> > _______________________________________________
>> > mantisbt-dev mailing list
>> > man...@li...
>> > https://lists.sourceforge.net/lists/listinfo/mantisbt-dev
>> >
>>
>>
>>
>> --
>> http://robert.muntea.nu/
>>
>>
>> ------------------------------------------------------------------------------
>> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> Critical Workloads, Development Environments & Everything In Between.
>> Get a Quote or Start a Free Trial Today.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> _______________________________________________
>> mantisbt-dev mailing list
>> man...@li...
>> https://lists.sourceforge.net/lists/listinfo/mantisbt-dev
>>
>
>