- up to 4.2.10; fixes CVE-014-9472, CVE-2015-1165, CVE-2015-1464

[packages/rt.git] / content-id.patch

From d2e519d4ed50ccc8f44b66b814f47de5ff63d0cc Mon Sep 17 00:00:00 2001
From: Przemyslaw Plewa <przemyslaw.plewa@domena.pl>
Date: Fri, 6 Feb 2015 13:50:11 +0100
Subject: [PATCH] Use Content-ID when handling multipart message over REST.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Record Content-ID identifier that came over REST API.

This allows us to have multipart messages with one (or more) part
refering to other parts of message. Content-ID identifier is used for
reference.

Such message also needs multipart/related type (instead of default (in
rt) multipart/mixed. So if we detect Content-ID in any part of multipart
message we switch Content-Type to multipart/related.

Signed-off-by: Przemysław Plewa <przemyslaw.plewa@domena.pl>
---
 lib/RT/Interface/REST.pm | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/RT/Interface/REST.pm b/lib/RT/Interface/REST.pm
index edfc5d3..1c8f555 100644
--- a/lib/RT/Interface/REST.pm
+++ b/lib/RT/Interface/REST.pm
@@ -324,11 +324,17 @@ sub process_attachments {
         }
 
         my $info = $cgi->uploadInfo($fh);
+        # If Content-ID exists for attachment then we need multipart/related
+        # to be able to refer to this Content-Id in core of mime message
+        if($info->{'Content-ID'}) {
+            $entity->head->set('Content-Type', 'multipart/related');
+        }
         my $new_entity = $entity->attach(
             Path => $tmp_fn,
             Type => $info->{'Content-Type'} || guess_media_type($tmp_fn),
             Filename => $file,
             Disposition => $info->{'Content-Disposition'} || "attachment",
+            'Content-ID' => $info->{'Content-ID'},
         );
         $new_entity->bodyhandle->{'_dirty_hack_to_save_a_ref_tmp_fh'} = $tmp_fh;
         $i++;
-- 
2.3.0