Skip to content
GitLab
Switch branch/tag
  1. 07 Jan, 2013 1 commit
  3. 03 Jan, 2012 1 commit
  5. 16 Nov, 2011 1 commit
    • Thomas Sibley's avatar
      Iterate attachments as the creator of the current transaction when sending mail · c29107c6
      Thomas Sibley authored 
      Check CurrentUserCanSee before trying to add an attachment since it
could otherwise end up empty now that we have the correct current user.

Additionally, simply check RT::Transaction's CurrentUserCanSee when
iterating inside an RT::Attachments object rather than maintaining a
different but similar conditional tree.  CurrentUserCanSee correctly
access checks transaction types like EmailRecord, for example.

This resolves part of CVE-2011-2084.
      c29107c6
  7. 03 Mar, 2011 1 commit
  9. 15 Feb, 2011 3 commits
  11. 28 Dec, 2010 5 commits
  13. 19 Sep, 2010 2 commits
  15. 29 Jul, 2010 2 commits
  17. 06 Jan, 2009 2 commits
  19. 04 Dec, 2008 1 commit
  21. 11 Jul, 2008 1 commit
  23. 09 Jun, 2008 1 commit
  25. 24 Apr, 2008 1 commit
  27. 11 Apr, 2008 2 commits
  29. 28 Feb, 2008 1 commit
  31. 07 Aug, 2007 1 commit
  33. 26 May, 2007 3 commits
  35. 22 May, 2007 1 commit
  37. 01 May, 2007 1 commit
  39. 24 Apr, 2007 2 commits
  41. 22 Mar, 2007 4 commits
  43. 05 Mar, 2007 1 commit
  45. 27 Oct, 2006 2 commits