#mantisbt — Public Fediverse posts

Hmm I'm now looking at self-hosted Gitlab instead of MantisBT for small projects. Just for issue-tracking.

#Gitlab #MantisBT

Ah it looks like there is an existing dark mode plugin that seems to work and there is an internal event it hooks to called EVENT_LAYOUT_RESOURCES where you can just fire a callback to add an additional CSS file that can overwrite the native CSS file that's being loaded.

For customizing the theme colors and fonts it looks like that might be enough. Hmmm

#MantisBT

Ugh. Looks like the MantisBT hooks are limited and haven't been updated in a while. Also there aren't any good plugins for theme customization. :( Not enough community support.

https://mantisbt.org/forums/viewforum.php?f=4

#MantisBT

I wish there was more active community development for #MantisBT. It could use more themes.

…and for those who wondered about the recurring MantisBT example in the screenshots - that is one of my end-to-end scenarios I use to test the practical viability of the Reconcile Engine, including things like volume management.

The scope is deliberately host-centric. It is not a cluster-wide deployment model like Kubernetes, but always framed around something like a sovereign home server, where I simply want to manage and operate my services in a clean and structured way.

For example, running a bug tracker with its database and reverse proxy - or something entirely different, like a Luanti game server for my son.

Some documentation has also started to emerge, because at this point it can no longer really be explained in a one-pager:

https://netbsd-cells.petermann-digital.de/docs/end-to-end-recipes/mantisbt-end-to-end-example/index.html

https://netbsd-cells.petermann-digital.de/docs/end-to-end-recipes/luanti-gameserver-end-to-end-example/index.html

#netbsd #devops #modernretrocomputing #luanti #mantisbt #selfhosted #clt2026

Several months ago, I found a #vulnerability from #MantisBT - Authentication bypass for some passwords due to PHP type juggling (CVE-2025-47776).

Any account that has a password that results in a hash that matches ^0+[Ee][0-9]+$ can be logged in with a password that matches that regex as well. For example, password comito5 can be used to log in to the affected accounts and thus gain unauthorised access.

The root cause of this bug is the incorrect use of == to match the password hash:

if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password )

The fix is to use === for the comparison.

This vulnerability has existed in MantisBT ever since hashed password support was added (read: decades). MantisBT 2.27.2 and later include a fix to this vulnerability. https://mantisbt.org/download.php

#CVE_2025_47776 #infosec #cybersecurity

Filed an issue at #MantisBT in 2010. Got a response today. Time flies.

Introducing #MantisBT - a #FOSS bug tracker

https://thishosting.rocks/introducing-mantisbt-a-foss-bug-tracker/

I see that there's a new release for MantisBT with a security fix. Update now 🚀

https://mantisbt.org/blog/archives/mantisbt/753

#MantisBT