Custom Query (332 matches)


Show under each result:

Results (205 - 207 of 332)

Ticket Resolution Summary Owner Reporter
#203 fixed [PATCH]: Allow restricting ticket updates to ticket participants bas kris@…

USE CASE: I use email2trac to integrate an internal instance of Trac with traditional user support ticketing via email. This is great, because it keeps both internal and external issues under the same roof. Users simply send in their support requests via e-mail and email2trac + Trac notifications handle the rest while keeping Trac itself restricted. [ Parenthetically, by use of tags and an outgoing filter in the MTA, external tickets can also have internal comments allowing us to define which updates are to be sent out externally. This would of course be better to implement in the Trac layer, but it does the job. ]

PROBLEM: With ticket_update on, email2trac allows any ticket to be updated by just changing the ticket number in the Subject. While great for an open Trac, it opens a security hole when Trac is used for private ticketing. Example:

1) mike@… has a ticket #453: Someone hijacked my account

2) steve@… sends a random email with the same ticket number, eg. #453: Sneak me in which appends his comment to a ticket he should have no access to. If always_notify_updater is on, it will also add him to the notification list. The sender anomaly is easy to miss and scanning for it a needless mental burden. Obviously, the intent may not even be malicious, eg. Steve may have corrupted the Subject line by accident.

PATCHED BEHAVIOR: by turning on ticket_update_restricted_to_participants, a ticket update is allowed only if 1) the updater is the reporter, 2) the updater is in the CC or 3) the updater matches a Trac username (i.e. is staff). If the update is denied, a new ticket will be generated instead as to not loose the issue (NOTE: the current trunk will drop any e-mail that has a ticket number which does not match a ticket; this patch also fixes that as a side-effect).

---    (revision 375)
+++    (working copy)
@@ -197,6 +197,11 @@
                        self.TICKET_UPDATE = 0

+               if parameters.has_key('ticket_update_restricted_to_participants'):
+                       self.TICKET_UPDATE_RESTRICTED_TO_PARTICIPANTS = int(parameters['ticket_update_restricted_to_participants'])
+               else:
+                       self.TICKET_UPDATE_RESTRICTED_TO_PARTICIPANTS = 0
                if parameters.has_key('ticket_update_by_subject'):
                        self.TICKET_UPDATE_BY_SUBJECT = int(parameters['ticket_update_by_subject'])
@@ -762,6 +767,42 @@
               = None
                        return False

+                       # Is the updater the reporter?
+                       # Since all Trac users are allowed to update, it does
+                       # not matter if any of our fields contain usernames
+                       # instead of emails.
+                       #
+                       if tkt['reporter'] and self.email_addr.lower() == tkt['reporter'].lower():
+                               if self.DEBUG:
+                                       print 'Restricted update: ALLOW, %s is the ticket reporter' %(self.email_addr)
+                       # Is the updater in the CC?
+                       elif tkt['cc'] and self.email_addr.lower() in tkt['cc'].lower().replace(' ', '').split(','):  # assuming space is fragile, hence replace()
+                               if self.DEBUG:
+                                       print 'Restricted update: ALLOW, %s is in the CC' %(self.email_addr)
+                       else:
+                               tkt_allow_update = False
+                               # Is the update a Trac user?
+                               for username, name, email in self.env.get_known_users():
+                                       if email and email.lower() == self.email_addr.lower():
+                                               tkt_allow_update = True
+                                               if self.DEBUG:
+                                                       print 'Restricted update: ALLOW, %s matches username %s' %(self.email_addr, username)
+                                               break
+                               # No luck? Fail the update.
+                               if not tkt_allow_update:
+                                       if self.DEBUG:
+                                               print 'Restricted update: DENIED, %s does not match a username nor is it the reporter or in the CC' %(self.email_addr)
+                              = None
+                                       return False
                # How many changes has this ticket
                cnum = len(tkt.get_changelog())

@@ -1486,7 +1527,11 @@
                        if'reply') and self.TICKET_UPDATE:
                                self.system = 'ticket'
-                               self.ticket_update(m,'reply'), spam_msg)
+                               result = self.ticket_update(m,'reply'), spam_msg)
+                               # If the ticket was not found, create a new one instead of loosing it
+                               if not result:
+                                       self.new_ticket(m, subject, spam_msg)

                        # New ticket + fields

Looking forward to seeing whether you think this is something that should go into the release. The patch itself is rather verbose due to the debugging. FWIW this was also my first foray into Python, apologies if the patch is not very Pythonic. :)

Thanks a lot for your efforts, keep up the great work!


#180 fixed patch allow specific tracs to disable workflow on tickets bas zac@…

Here's the patch. It allows individual trac instances to be configured to stop tickets from automatically being reopened on email. It defaults to off:

--- /usr/bin/email2trac 2009-10-03 00:01:24.000000000 +0000
+++ /root/email2zac     2010-02-14 02:50:49.000000000 +0000
@@ -267,6 +267,11 @@
                        self.IGNORE_TRAC_USER_SETTINGS = 0
+               if parameters.has_key('email_triggers_workflow'):
+                       self.EMAIL_TRIGGERS_WORKFLOW = int(parameters['email_tri
+               else:
+                       self.EMAIL_TRIGGERS_WORKFLOW = 1
        def spam(self, message):
                # X-Spam-Score: *** (3.255) BAYES_50,DNS_FROM_AHBL_RHSBL,HTML_
@@ -644,7 +649,7 @@
                # reopen the ticket if it is was closed
                # We must use the ticket workflow framework
-               if tkt['status'] in ['closed']:
+               if tkt['status'] in ['closed'] and self.EMAIL_TRIGGERS_WORKFLOW:
                        #print controller.actions['reopen']
#90 fixed [Patch] eMail with 'alternate_notify_template' after creation does not work bas hju@…

I tried to use a modified copie of /usr/lib/python2.4/site-packages/Trac-0.11-py2.4.egg/trac/ticket/templates/ticket_notify_email.txt as template for the initial notification to the reporter. This copy is placed in the same directory an specified in email2trac.conf

project: /home/trac/ticket
debug: 1
umask: 022
spam_level: 5
reply_all : 0
mailto_link: 0
umask: 022
email_header: 0
trac_version: 0.11
enable_syslog: 1
alternate_notify_template: new_notify.txt
drop_spam: 0
verbatim_format: 0
strip_signature: 1
email_quote: >
strip_quotes: 1
ignore_trac_user_settings: 0
ticket_update: 1
blacklist: MAILER-DAEMON@

Trac-notification and reporter-notification is enabled, but always ticket_notify_email.txt is used as template.

always_notify_owner = true
always_notify_reporter = true
always_notify_updater = false
mime_encoding = base64
nevernotifyupdater = true
reporter_states = new,closed,reopened
smtp_always_bcc =
smtp_always_cc = 
smtp_default_domain = 
smtp_enabled = true

I've browsed the source to find the clue, but I found no bug. As I anderstood, the "standard-process" of notification is used to get_recipients. Therefore it is no additional notification sent but the replacement of the normal notification depending on the settings for notification (means: if always_notify_reporter = false there will never be a notification send to reporter.

Did I miss anything in the manual?

Is there any hidden option to enable it?

Note: See TracQuery for help on using queries.