[Mantisbt-announce] Mantis 1.0.0rc4 Released

[Victor B. <vi...@fu...>]

Hi All,

 

Mantis 1.0.0rc4 is now available for download. 

http://sourceforge.net/project/showfiles.php?group_id=14963
<http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=1217
5> &package_id=12175

 

This candidate release includes the following fixes:

 

- 0006421: [security] Private bugs show up in public RSS feed (vboctor)

- 0006458: [security] Port #6457: SQL Injection in manage user page
(TKADV2005-11-002) (vboctor)

- 0006461: [security] Port #6460: HTTP Header CRLF Injection
(TKADV2005-11-002) (vboctor)

- 0006485: [security] XSS Vulnerability in filters (TKADV2005-11-002)
(thraxisp)

- 0006489: [security] Port Injection Vulnerabilities in Filters
(TKADV2005-11-002) (thraxisp)

- 0006492: [security] Port #6453: Make note private has no effect when
resolving bug (thraxisp)

- 0006432: [bugtracker] error processing does not work! (jlatour)

- 0006379: [filters] Filter returns private issues when it should not
(thraxisp)

- 0006254: [localization] strings_korean_utf8.txt has UTF-8 byte-order
marker (ryandesign)

- 0006268: [localization] strings_chinese_simplified_utf8.txt has UTF-8
byte-order marker (ryandesign)

- 0006304: [localization] [PATCH] Major overhaul of strings_dutch.txt
(jlatour)

- 0006358: [localization] Updated Dutch localization (Wanderer)

- 0006474: [localization] Calls to htmlspecialchars should take into account
the current charset (jlatour)

 

All 1.0.0ax / 1.0.0rcx users are encouraged to upgrade to this release.

 

I'd like to take this opportunity to thank tk at trapkit dot de for
reviewing Mantis code and reporting most of the security issues that were
fixed in this release.

 

Regards,

Mantis Team