rpc: harden closeIssue access checks/validation

[glensc]

similarly to #280, validate parameters at server side.

i didn't bother to think much, just added similar checks as #280 has:

        $this->checkIssuePermissions($issue_id);
        $this->checkIssueAssignment($issue_id);


        if (!Access::canChangeStatus($issue_id, $usr_id)) {
            throw new RemoteApiException("User has no access to update issue #$issue_id");
        }

also checks if issue is not already closed:

        if (Issue::isClosed($issue_id)) {
            throw new RemoteApiException("Issue #$issue_id already closed");
        }

[glensc]

also, i think i found bug:

        // FIXME: this doesn't validate that the status belongs to $issue_id's project
        $status_id = Status::getStatusID($new_status);
        if (!$status_id) {
            throw new RemoteApiException("Invalid status: $new_status");
        }

how do you suggest to fix this (if at all) is there already method for that?

[glensc]

@balsdorf ping, also have you finished your parts for 3.3.0 release?

[balsdorf]

This looks good. I've added one specific comment about the bug you reported and once that is fixed this looks good to merge.

[balsdorf]

For this I'd change it to

if (!$status_id || !in_array(Issue::getProjectID($issue_id), Status::getAssociatedProjects($status_id)) {

which will take care of checking if the status belongs to the project.

[balsdorf]

Sorry I totally missed this. Review submitted.

I don't think I had anything else for 3.3.0, just merging the attachment changes. If you know of anything, let me know and I'll knock it out.

[glensc]

documentation update that 5.6 is now required version. this what i had in mind.

[balsdorf]

@glensc I've updated the docs to say that only 5.6 is supported now.

[glensc]

i'm fine with making 3.3.0 release. altho i can't test it myself before having applied attachments PR. haven't figured out do i need to increase storage for mysql partition or not. or how much...

actually created #300 for this (3.0.0 for #300 nice coincidence!)