[Rt-commit] rt branch 5.0/stop-ticket-create-modify-on-invalid-recipients created. rt-5.0.2-113-g33139a985e

[BPS Git Server]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "rt".

The branch, 5.0/stop-ticket-create-modify-on-invalid-recipients has been created
        at  33139a985eac461728c36cca5e2d0a0edcf521bf (commit)

- Log -----------------------------------------------------------------
commit 33139a985eac461728c36cca5e2d0a0edcf521bf
Author: Brian Conry <bconry at bestpractical.com>
Date:   Thu Mar 24 12:58:44 2022 -0500

    Block ticket create/update on invalid recipients
    
    The prior behavior was to proceed with the ticket create or update,
    excluding the recipients that did not look like email addresses and
    could not be resolved to users (e.g. by Name), and without letting the
    user know that some intended recipients had been omitted.
    
    The new behavior is to block the action and give the user a message
    explaining that no user could be found for what they entered.

diff --git a/share/html/Ticket/Create.html b/share/html/Ticket/Create.html
index 5ae39fd4e5..036f7193d5 100644
--- a/share/html/Ticket/Create.html
+++ b/share/html/Ticket/Create.html
@@ -506,6 +506,8 @@ if ($ARGS{IncludeArticleId}) {
 
 # check email addresses for RT's
 {
+    my $user_check = RT::User->new($session{'CurrentUser'});
+
     foreach my $field ( qw(Requestors Cc AdminCc) ) {
         my $value = $ARGS{ $field };
         next unless defined $value && length $value;
@@ -524,7 +526,14 @@ if ($ARGS{IncludeArticleId}) {
                 }
             }
             else {
-                push @emails, $entry->{value};
+                my ($r,$m) = $user_check->Load($entry->{value});
+                if (!$r or !$user_check->id) {
+                    push @results, loc("Couldn't add user '[_2]' as [_1]: [_3]", $field, $entry->{value}, $m);
+                    $checks_failure ||= 1;
+                }
+                else {
+                    push @emails, $entry->{value};
+                }
             }
         }
         $ARGS{ $field } = join ', ', grep defined, @emails;
diff --git a/share/html/Ticket/Update.html b/share/html/Ticket/Update.html
index c1b7f38cf0..78bf06e75c 100644
--- a/share/html/Ticket/Update.html
+++ b/share/html/Ticket/Update.html
@@ -423,6 +423,8 @@ if ( $ARGS{'SubmitTicket'} ) {
 
 # check email addresses for RT's
 {
+    my $user_check = RT::User->new($session{'CurrentUser'});
+
     foreach my $field ( qw(UpdateCc UpdateBcc) ) {
         my $value = $ARGS{ $field };
         next unless defined $value && length $value;
@@ -441,7 +443,14 @@ if ( $ARGS{'SubmitTicket'} ) {
                 }
             }
             else {
-                push @emails, $entry->{value};
+                my ($r,$m) = $user_check->Load($entry->{value});
+                if (!$r or !$user_check->id) {
+                    push @results, loc("Couldn't add user '[_2]' as [_1]: [_3]", $field, $entry->{value}, $m);
+                    $checks_failure ||= 1;
+                }
+                else {
+                    push @emails, $entry->{value};
+                }
             }
         }
         $ARGS{ $field } = join ', ', grep defined, @emails;

-----------------------------------------------------------------------


hooks/post-receive
-- 
rt