View Issue Details

IDProjectCategoryView StatusLast Update
0025997mantisbtapi restpublic2019-08-25 12:36
Reporterdregad Assigned Todregad  
PrioritynormalSeverityminorReproducibilitysometimes
Status closedResolutionfixed 
Product Version2.18.0 
Target Version2.22.0Fixed in Version2.22.0 
Summary0025997: Invalid JSON response when creating issue with tag by name via REST API
Description

When attempting to create an issue with the REST API and the payload includes at least one existing tag specified by name, IssueAddCommand::process() triggers a PHP notice as it checks the value of $t_tag['id'].

Depending on PHP error_reporting settings, an HTML error message is appended to the expected JSON response, causing it to become invalid.

Steps To Reproduce
  • Set error_reporting = E_ALL
  • Create issue
    $ curl --location -w "%{http_code}" --request POST "http://path/to/mantisbt/api/rest/issues/"   --header "Authorization: XXXX"   --header "Content-Type: application/json"   --data "{
    \"summary\": \"Test add issue with tags $(date +%T)\",
    \"description\": \"Test description\",
    \"category\": {
    \"name\": \"General\"
    },
    \"project\": {
    \"name\": \"Test project\"
    }, \"tags\": [ { \"name\": \"existing-tag\" }, {} ]
    }"

Returns

{"issue":{"id":22218,"summary":"Test with tags 14:05:28","description":"This is a test description","project":{"id":1,"name":"mantisbt"},
[...]
&quot;type&quot;:{&quot;id&quot;:25,&quot;name&quot;:&quot;tag-added&quot;},&quot;tag&quot;:{&quot;id&quot;:&quot;218&quot;,&quot;name&quot;:&quot;modern-ui&quot;},&quot;message&quot;:&quot;Tag Attached: modern-ui&quot;}]}}<br />
<b>Notice</b>:  Undefined index: id in <b>/path/to/mantisbt/core/commands/IssueAddCommand.php</b> on line <b>347</b><br />
TagsNo tags attached.

Relationships

related to 0024774 closedvboctor Error Creating Issue with new TAG 

Activities

dregad

dregad

2019-08-14 08:48

developer   ~0062566

The same problem occurs if the user attempting to create the issue does not have the required privileges to create tags (in that case, the NOTICE is thrown in IssueAddCommand::validate() at line 222).

dregad

dregad

2019-08-14 10:24

developer   ~0062570

PR https://github.com/mantisbt/mantisbt/pull/1542

Related Changesets

MantisBT: master 4e786bd2

2019-08-14 03:34

dregad


Details Diff
Fix PHP Notice in IssueAddCommand

The code did not check for existence of `id` key in $t_tag before trying
to access it.

This caused REST API to generate an invalid JSON response when creating
issue with tag by name.

Fixes 0025997
Affected Issues
0025997
mod - core/commands/IssueAddCommand.php Diff File