URLs in free text area (story/bug descriptions etc) should be converted to html links with target=_blank

As a potential user, I would like to know whether zentao has been through the zentao management of the new version of zentao.

If implemented, where can I find, real inside demo ?

If not implemented, then why.
Hosted in Github did not close the Issue system, because the Issue system is better than zentao, or because zentao has not yet reached the point of maturity?

This article shows the advantages and some of the reasons why it is worth making the change.
https://kinsta.com/knowledgebase/convert-myisam-to-innodb/

如题。

开发组件安全日益重要，大部分漏洞都是针对开发组件而言的，如果可以添加一个组件安全管理功能的话将对很多公司都有帮助

Fatal error: Can't use function return value in write context in /var/www/xxx.com/module/project/view/kanban.html.php on line 56
11:03:51 Can't use function return value in write context in /var/www/xxx.com/module/project/view/kanban.html.php on line 56 when visiting project-kanban-32

Happened

On Zentao installation’s system checkup http://127.0.0.1/zentao/install.php?m=install&f=step1, Zentao fails to check that /opt/zentao/tmp/ and /opt/zentao/www/data and their contents, recursively, have the expected permissions o=rwx.

See tree_-p_opt.log

Expected

If /opt/zentao/tmp/ and /opt/zentao/www/data and their contents recursively have the expected permissions o=rwx, tests for Temp Directory and Uploaded File Directory are Passed(√) and user can continue installing Zentao.

Reproduce

1. Install RHEL 8.4 or based distribution like AlmaLinux 8.4

2. sudo yum -y install git make zip unzip tar rpm-build mysql-server php php-json php-ldap php-pdo php-mysqlnd php-mbstring httpd

3. git clone https://github.com/easysoft/zentaopms.git

4. cd zentaopms && git checkout a14ee06288af519d4ccec8492320987ffe678fb6

5. Comment or remove the line make endeb from en: target of Makefile

6. make en

7. sudo rpm -ivh --force zentaoalm-15.3.int-1.noarch.rpmzentaoalm-15.3.int-1.noarch.rpm

8. Insert the following line at /etc/httpd/conf/httpd.conf

   ServerName localhost
   

9. sudo systemctl enable --now httpd.service

10. Open http://127.0.0.1/zentao/install.php

11. Click Start

12. Click Next

13. See Temp Directory and Uploaded File Directory are Failed(×)

14. sudo chmod -Rv o=rwx /opt/zentao/tmp && sudo chmod -Rv o=rwx /opt/zentao/www/data

15. Click Refresh

16. See Temp Directory and Uploaded File Directory are Failed(×)

System information

• AlmaLinux 8.4
• a14ee06

Zentao looks like a great software however without the ability to evaluate the software using the opensource version then may be transition to the paid version if needed
Installation instructions require some writing the read me file

Can you support apereo/cas ?

15:37:04 ERROR: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SELECT distinct t1., t2.,t3.branch as productBranch,t4.type as productType,t2.' at line 1
The sql is: SELECT product as name, count(product) as value FROM zt_story wHeRe SELECT distinct t1., t2.,t3.branch as productBranch,t4.type as productType,t2.version as version FROM zt_projectstory AS t1 LEFT JOIN zt_story AS t2 ON t1.story = t2.id LEFT JOIN zt_projectproduct AS t3 ON t1.project = t3.project LEFT JOIN zt_product AS t4 ON t2.product = t4.id WHERE t1.project = '32' AND t2.deleted = '0' gRoUp bY product oRdEr bY value DESC

in /var/www/p.xxx.com/lib/base/dao/dao.class.php on line 1301, last called by /var/www/p.xxx.com/lib/base/dao/dao.class.php on line 707 through function sqlError.
in /var/www/p.xxx.com/framework/base/router.class.php on line 1919 when visiting story-report-10-unclosed-0

我以前都是在你们开源官网下载
下载站点1：http://sourceforge.net/projects/zentao/files/9.8.3/ZenTaoPMS.9.8.3.zip/download

今天我fork一个git到本地，和我在用的代码比较后发现差异非常大，两套系统是不同团队在维护开发吗？

Portuguese-BR translation

初级版本：提需求前需要扫描收款码支付后才可进入详情编辑页面，收款码可由管理员在后台设置；
高级版本：提需求时不需要付款，指派给某个人时需要扫描收款码，每个人的收款码可由该用户自定义；

Olla,
on my hosting cant really use Options +FollowSymLinks +SymLinksIfOwnerMatch in htaccess. Its there a way how to use it even without it ?

Seems like all working but thers a file location trouble aka
(12:57:26 ERROR: 'theme/default/en.default' illegal. in framework/base/router.class.php on line 1287, last called by framework/base/router.class.php on line 1194 through function checkModuleName. in framework/base/router.class.php on line 2215 when visiting theme/default/en.default)

edit1. route for file either dont work :/

Can you help me?

clone 当前项目到本地运行. 界面混乱. 缺少 all.js zh-cn.default.css 文件.

There is a stored XSS vulnerability in the comment edit and software version is 11.6.4.
The following poc is valid:
"'<img src=1 onerror=alert(document.cookie); />
<div onmouseover='alert(document.cookie)'>1

The vulnerability step is：
1.Product->Overview
2.Capture packets by burpsuite when you edit comment.
3.Change value of "lastComment" into "'<img src=1 onerror=alert(document.cookie); /> or <div onmouseover='alert(document.cookie)'>1
4.Saving successfully and users' cookies will appear.

我在定时器里面增加了自定义参数，还支持post/get请求其他地址，不知道你们是否需要，我也不知道怎么提交代码给你们，这是我的仓库
wcj343169893/zentaopms@f9f2b39

Hi there,

I couldn't find a SECURITY.md in your repository and am not sure how to best contact you privately to disclose a security issue.

Can you add a SECURITY.md file with an e-mail to your repository, so that our system can send you the vulnerability details? GitHub suggests that a security policy is the best way to make sure security issues are responsibly disclosed.

Once you've done that, you should receive an e-mail within the next hour with more info.

Thanks! (cc @huntr-helper)

官网都发布开源版15.0了，github仓库不更新了吗？

举例：原公司名称是：“公司A”

即使之后修改了公司名称为：“公司B”

在邮件提醒中显示的公司名还是 “公司A”，但是指派任务发送的邮件显示的是新公司“公司B”

估计：是初始化项目设置公司的时候有配置文件记录了公司A，每日提醒邮件使用的是配置文件

PMS's Global and some Funtion Access Control implemented by getRemoteIp(), but it gets client ip by improper method, an attacker can forge unblocked address to bypass Access Control Strategy.

getRemoteIp() try to get client ip value from $_SERVER['HTTP_CLIENT_IP'] > $_SERVER["HTTP_X_FORWARDED_FOR"] > $_SERVER["REMOTE_ADDR"]. But, HTTP_CLIENT_IP，HTTP_X_FORWARDED_FOR extracted from HTTP Request Headers, attacker can forge a HTTP Request with header like X-Forwarded-For: 127.0.0.1 to bypass IP Block.

this function use in four places:

common\model.php // bypass IP white-list to System 
base\router.class.php  // bypass 127.0.0.1 access limitation to detail error-log

//functions below , removed in latest version -.-
editor\control.php // bypass 127.0.0.1 access limitation to editor function
translate\control.php // bypass 127.0.0.1 access limitation to translate function

解决方法：
SET SQL_MODE='ALLOW_INVALID_DATES'; ALTER TABLE zt_teamADDtypeenum('project','task') NOT NULL DEFAULT 'project' FIRST; ALTER TABLEzt_teamADDroot` mediumint(8) unsigned NOT NULL default '0' FIRST;

ALTER TABLE zt_team DROP PRIMARY KEY;
ALTER TABLE zt_team DROP project;
ALTER TABLE zt_team DROP task;
`

错误信息：
10:31:53 ERROR: SQLSTATE[42S22]: Column not found: 1054 Unknown column 't3.type' in 'where clause'<p>The sql is: SELECT distinct t1.id FROMzt_productAS t1 LEFT JOINzt_projectproductAS t2 ON t1.id = t2.product LEFT JOINzt_teamAS t3 ON t2.project = t3.root LEFT JOINzt_project` AS t4 ON t2.project = t4.id wHeRe t1.acl = 'open' OR (t1.acl = 'custom' AND (INSTR(CONCAT(',', t1.whitelist, ','), ',1,') > 0 OR INSTR(CONCAT(',', t1.whitelist, ','), ',6,') > 0 OR INSTR(CONCAT(',', t1.whitelist, ','), ',9,') > 0)) OR t1.PO = 'leeyi' OR t1.QD = 'leeyi' OR t1.RD = 'leeyi' OR t1.createdBy = 'leeyi' OR t3.account = 'leeyi' AND t1.deleted = '0' AND t3.type = 'project' AND t4.deleted = '0'

10:31:53 ERROR: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'root' in 'field list'

The sql is: SELECT root, account FROM zt_team wHeRe type = 'project'

I'm trying to update the client, but to no avail.

This is the message that I'm getting:

The path is writable and while it tries to generate a zip file, it's zero MB :/

Thanks in advance for any help! :)

Hi,

congratulations for this nice project!

The past few days I tested your Project and I really like it.
That's why I created a German translation.
Do you want me to create a Pull Request or how do you want me to contribute?

Kind regards
Phillip

禅道项目管理软件任意文件写入漏洞（需要登录）
http://wooyun.org/bugs/wooyun-2015-0151565
禅道项目管理软件 SQL注入漏洞（无需登录）
http://wooyun.org/bugs/wooyun-2015-0151486

请官方确认一下此漏洞，谢谢！

Hello,

OpenId Connect is one of the major authentication protocols used today and one of the first to be used for federated access, giving it a large foothold in the SSO domain, so is there any plan to support it?

OpenId Connect libs for PHP : https://github.com/jumbojett/OpenID-Connect-PHP

Thanks,
Savorboard

php 7.4 对索引有了更加严格的要求， $a{0} 这种方式的调用已经被标记为失效了

What is the Difference between open source and paid version?

问题：如果安装的时候修改了表前缀，升级的时候就会报表不一致的提示。

解决：

把

$table = str_replace('zt_', $this->config->db->prefix, $out[1][0]);

Screen shots are needed on the github page and wiki to describe the application features and benefits.

• git版本库禅道配置
  

• git触发jenkins任务构建配置
  

• 后台计划任务显示正常
  

• 实际结果并未按照git tag触发构建，而是每5分钟触发一次
  

• 同时jenkins任务构建失败
  Started by user jiaxuefeng
  Running as SYSTEM
  Building on master in workspace E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git
  [WS-CLEANUP] Deleting project workspace...
  [WS-CLEANUP] Deferred wipeout is used...
  [WS-CLEANUP] Done
  No credentials specified
  Cloning the remote Git repository
  Cloning repository https://gitee.com/jjxff2000/ci_test_testng.git

git.exe init E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git # timeout=10
Fetching upstream changes from https://gitee.com/jjxff2000/ci_test_testng.git
git.exe --version # timeout=10
git.exe fetch --tags --force --progress https://gitee.com/jjxff2000/ci_test_testng.git +refs/heads/:refs/remotes/origin/
git.exe config remote.origin.url https://gitee.com/jjxff2000/ci_test_testng.git # timeout=10
git.exe config --add remote.origin.fetch +refs/heads/:refs/remotes/origin/ # timeout=10
git.exe config remote.origin.url https://gitee.com/jjxff2000/ci_test_testng.git # timeout=10
Fetching upstream changes from https://gitee.com/jjxff2000/ci_test_testng.git
git.exe fetch --tags --force --progress https://gitee.com/jjxff2000/ci_test_testng.git +refs/heads/:refs/remotes/origin/
git.exe rev-parse "refs/remotes/origin/master^{commit}" # timeout=10
git.exe rev-parse "refs/remotes/origin/origin/master^{commit}" # timeout=10
Checking out Revision 78df1cdaed6a72c413f798d882e1d635aa46f352 (refs/remotes/origin/master)
git.exe config core.sparsecheckout # timeout=10
git.exe checkout -f 78df1cdaed6a72c413f798d882e1d635aa46f352
Commit message: "update pom.xml. for zentao0.4"
git.exe rev-list --no-walk 78df1cdaed6a72c413f798d882e1d635aa46f352 # timeout=10
[ZTF-TestNg-Git] $ cmd /c call C:\Users\ADMINI~1\AppData\Local\Temp\jenkins132678985567278885.bat

E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git>echo
ECHO 处于打开状态。

E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git>exit 0
[ZTF-TestNg-Git] $ cmd /c call C:\Users\ADMINI~1\AppData\Local\Temp\jenkins3844686234650660713.bat

E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git>ztf.exe testng -p 001 mvn clean package test
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------< com.ngtesting.ci:ci_test_testng >-------------------
[INFO] Building ci_test_testng 0.4-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-clean-plugin:2.5:clean (default-clean) @ ci_test_testng ---
[INFO]
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ ci_test_testng ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] skip non existing resourceDirectory E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git\src\main\resources
[INFO]
[INFO] --- maven-compiler-plugin:3.1:compile (default-compile) @ ci_test_testng ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 2 source files to E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git\target\classes
[INFO]
[INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ ci_test_testng ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 1 resource
[INFO]
[INFO] --- maven-compiler-plugin:3.1:testCompile (default-testCompile) @ ci_test_testng ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 1 source file to E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git\target\test-classes
[INFO]
[INFO] --- maven-surefire-plugin:2.12.4:test (default-test) @ ci_test_testng ---
[INFO] Surefire report directory: E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git\target\surefire-reports

T E S T S

Running com.ngtesting.autotest.test.TestLogin
Configuring TestNG with: org.apache.maven.surefire.testng.conf.TestNG652Configurator@6d86b085
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 2.488 sec

Results :

Tests run: 3, Failures: 0, Errors: 0, Skipped: 0

[INFO]
[INFO] --- maven-jar-plugin:2.4:jar (default-jar) @ ci_test_testng ---
[INFO] Building jar: E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git\target\ci_test_testng-0.4-SNAPSHOT.jar
[INFO]
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ ci_test_testng ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] skip non existing resourceDirectory E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git\src\main\resources
[INFO]
[INFO] --- maven-compiler-plugin:3.1:compile (default-compile) @ ci_test_testng ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ ci_test_testng ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 1 resource
[INFO]
[INFO] --- maven-compiler-plugin:3.1:testCompile (default-testCompile) @ ci_test_testng ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- maven-surefire-plugin:2.12.4:test (default-test) @ ci_test_testng ---
[INFO] Skipping execution of surefire because it has already been run for this configuration
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 14.012 s
[INFO] Finished at: 2020-06-17T10:50:59+08:00
[INFO] ------------------------------------------------------------------------

==================================================================================================================================== 2020-06-17 10:51:00 found_scripts: ===================================================================================================================================
(1/3) pass [com.ngtesting.autotest.test.TestLogin] [1. loginSuccess] (0.041s)
(2/3) pass [com.ngtesting.autotest.test.TestLogin] [2. loginFail] (0.004s)
(3/3) pass [com.ngtesting.autotest.test.TestLogin] [3. loginFail] (0.003s)

2020-06-17 10:51:00 run_scripts
{"env":"windows","testType":"unit","testFrame":"testng","productId":1,"taskId":0,"zentaoData":"compile=137","buildUrl":"http://localhost:9000/job/ZTF-TestNg-Git/13/","pass":3,"fail":0,"skip":0,"total":3,"startTime":1592362240,"endTime":1592362260,"duration":20,"funcResult":null,"unitResult":[{"title":"loginSuccess","testSuite":"com.ngtesting.autotest.test.TestLogin","duration":0.041,"failure":null,"id":1,"status":"pass"},{"title":"loginFail","testSuite":"com.ngtesting.autotest.test.TestLogin","duration":0.004,"failure":null,"id":2,"status":"pass"},{"title":"loginFail","testSuite":"com.ngtesting.autotest.test.TestLogin","duration":0.003,"failure":null,"id":3,"status":"pass"}]}

fail_to_submit_test_result
server_return

E:\fengfeng\work_tools\MyJenkinsWorkSpace\workspace\ZTF-TestNg-Git>exit 1
Build step 'Execute Windows batch command' marked build as failure
Finished: FAILURE

之前使用 redmine 所有的issue 都是可以标记进行中状态的，关闭后会有工时统计，禅道能不能加上

在md文档里使用了>符号后会有很多内容消失

http://www.wooyun.org/bugs/wooyun-2015-0151486

After git cloninig and setup (which went fine). The site seems to e fully destructed in english in case of missing the en_*****.css file/s within the Theme folders.
<link rel='stylesheet' href='/theme/default/en.default.css?v=10.0.beta' type='text/css' media='screen' />

在MySQL8中，不管是用工具导入，还是命令行导入都会报错，导致有几张表导入失败，报错如下：

[ERROR in query 17] Invalid default value for 'begin'
[ERROR in query 42] Invalid default value for 'join'
[ERROR in query 49] Invalid default value for 'birthday'
[ERROR in query 59] Incorrect datetime value: '0000-00-00 00:00:00' for column 'lastTime' at row 1

主要是由于date或者datetime类型引起
有些表也有同样的字段，但是没有问题，所以希望能不能所有的表统一类型定义？

开源版8.2.6评审流程 不论设置为开启、关闭，新建需求、批量新建需求都是默认不需要评审。

After logging out, I clicked the back button on the browser and all the details were visible.

We would actually expect to be redirected back to login page.

我是专业版用户，希望有个好的渠道反映用户的需求（并不是说要求做，只是反馈供参考哦）
pms.zentao.net只有游客身份，在这里反映issue好像又不太合适

Hello,

I was trying to connect to zentao server via the client app, but I wasn't able to establish a connection, this is the diagnostics output:

I have opened the required ports:

These are the settings from zentao:

Is there anything else that I could do? I'm using zentao behind traefik and LetsEncrypt for https support, but I believe that shouldn't affect anything since it resolves to the IP and targets the 11443 port, which as shown in the screenshot is exposed...

Thanks!

Is easy for implement and free for Open Source projects
https://sonarcloud.io/

You need to signing with GitHub account and add project.

There exists XSS(stored) vulnerability in Rich Text Box.

The vulnerability replication process is as follows：

1. Capture packets when you add picture through Rich Text Box.
2. Then, change raw data into <img src="a" onerror="alert(document.cookie)" />.
3. After successful saving，users' cookies will pop up.

Remove support for php 5.x
https://www.php.net/supported-versions.php

Suggest php version 7.2 or newer

目前有这个功能吗？ 不是和ldap。我试了下开源，企业，都不行

在禅道11.0中提供了一个全新的暄暄作为客户端使用，并且提供了将禅道URL发到聊天窗口中即可转为卡片式消息，但是内置的禅道无法复制地址，也无法通过其他途径获得url，右键在浏览器中打开也没有一键登录功能，也就意味着如果需要发送卡片的话需要单独在浏览器中再次登录，那这样暄暄其实用处就不大了。

/index.php?mode=phpinfo

After logout if i navigate to /www i find my self logged in