import rt 3.4.4

11 files changed, 984 insertions, 305 deletions

diff --git a/rt/lib/RT/Interface/CLI.pm b/rt/lib/RT/Interface/CLI.pm
index 417999473..8c9329508 100644
--- a/rt/lib/RT/Interface/CLI.pm
+++ b/rt/lib/RT/Interface/CLI.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,7 +42,7 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 use strict;
 
 use RT;
@@ -55,7 +55,7 @@ BEGIN {
     use vars qw ($VERSION  @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
     
     # set the version for version checking
-    $VERSION = do { my @r = (q$Revision: 1.1.1.2 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; # must be all one line, for MakeMaker
+    $VERSION = do { my @r = (q$Revision: 1.1.1.3 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; # must be all one line, for MakeMaker
     
     @ISA         = qw(Exporter);
     
diff --git a/rt/lib/RT/Interface/Email.pm b/rt/lib/RT/Interface/Email.pm
index 04539a3a6..5db7c8aa7 100755
--- a/rt/lib/RT/Interface/Email.pm
+++ b/rt/lib/RT/Interface/Email.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,7 +42,7 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 package RT::Interface::Email;
 
 use strict;
@@ -56,7 +56,7 @@ BEGIN {
     use vars qw ($VERSION  @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);
     
     # set the version for version checking
-    $VERSION = do { my @r = (q$Revision: 1.1.1.4 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; # must be all one line, for MakeMaker
+    $VERSION = do { my @r = (q$Revision: 1.1.1.5 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; # must be all one line, for MakeMaker
     
     @ISA         = qw(Exporter);
     
@@ -64,15 +64,15 @@ BEGIN {
     # as well as any optionally exported functions
     @EXPORT_OK   = qw(
               &CreateUser
-		      &GetMessageContent
-		      &CheckForLoops 
-		      &CheckForSuspiciousSender
-		      &CheckForAutoGenerated 
-		      &MailError 
-		      &ParseCcAddressesFromHead
-		      &ParseSenderAddressFromHead 
-		      &ParseErrorsToAddressFromHead
-                      &ParseAddressFromHeader
+              &GetMessageContent
+              &CheckForLoops 
+              &CheckForSuspiciousSender
+              &CheckForAutoGenerated 
+              &MailError 
+              &ParseCcAddressesFromHead
+              &ParseSenderAddressFromHead 
+              &ParseErrorsToAddressFromHead
+              &ParseAddressFromHeader
               &Gateway);
 
 }
@@ -139,8 +139,8 @@ sub CheckForSuspiciousSender {
 
     my ($From, $junk) = ParseSenderAddressFromHead($head);
     
-    if (($From =~ /^mailer-daemon/i) or
-	($From =~ /^postmaster/i)){
+    if (($From =~ /^mailer-daemon\@/i) or
+	($From =~ /^postmaster\@/i)){
 	return (1);
 	
     }
@@ -159,13 +159,57 @@ sub CheckForAutoGenerated {
     if ($Precedence =~ /^(bulk|junk)/i) {
 	return (1);
     }
-    else {
-	return (0);
+    
+    # First Class mailer uses this as a clue.
+    my $FCJunk = $head->get("X-FC-Machinegenerated") || "";
+    if ($FCJunk =~ /^true/i) {
+        return (1);
     }
+
+    return (0);
 }
 
 # }}}
 
+# {{{ IsRTAddress
+
+=head2 IsRTAddress ADDRESS
+
+Takes a single parameter, an email address. 
+Returns true if that address matches the $RTAddressRegexp.  
+Returns false, otherwise.
+
+=cut
+
+sub IsRTAddress {
+    my $address = shift || '';
+
+    # Example: the following rule would tell RT not to Cc 
+    #   "tickets@noc.example.com"
+    if ( defined($RT::RTAddressRegexp) &&
+                       $address =~ /$RT::RTAddressRegexp/ ) {
+        return(1);
+    } else {
+        return (undef);
+    }
+}
+
+# }}}
+
+# {{{ CullRTAddresses
+
+=head2 CullRTAddresses ARRAY
+
+Takes a single argument, an array of email addresses.
+Returns the same array with any IsRTAddress()es weeded out.
+
+=cut
+
+sub CullRTAddresses {
+    return (grep { IsRTAddress($_) } @_);
+}
+
+# }}}
 
 # {{{ sub MailError 
 sub MailError {
@@ -270,7 +314,8 @@ sub CreateUser {
 
     return $CurrentUser;
 }
-# }}}	    
+# }}}
+
 # {{{ ParseCcAddressesFromHead 
 
 =head2 ParseCcAddressesFromHead HASHREF
@@ -296,10 +341,10 @@ sub ParseCcAddressesFromHead {
     foreach my $AddrObj (@ToObjs, @CcObjs) {
 	my $Address = $AddrObj->address;
 	$Address = $args{'CurrentUser'}->UserObj->CanonicalizeEmailAddress($Address);
- 	next if ($args{'CurrentUser'}->EmailAddress =~ /^$Address$/i);
-	next if ($args{'QueueObj'}->CorrespondAddress =~ /^$Address$/i);
-	next if ($args{'QueueObj'}->CommentAddress =~ /^$Address$/i);
-	next if (RT::EmailParser::IsRTAddress(undef, $Address));
+ 	next if ($args{'CurrentUser'}->EmailAddress =~ /^\Q$Address\E$/i);
+	next if ($args{'QueueObj'}->CorrespondAddress =~ /^\Q$Address\E$/i);
+	next if ($args{'QueueObj'}->CommentAddress =~ /^\Q$Address\E$/i);
+	next if (RT::EmailParser->IsRTAddress($Address));
 	
 	push (@Addresses, $Address);
     }
@@ -365,6 +410,8 @@ Takes an address from $head->get('Line') and returns a tuple: user@host, friendl
 sub ParseAddressFromHeader{
     my $Addr = shift;
     
+    # Perl 5.8.0 breaks when doing regex matches on utf8
+    Encode::_utf8_off($Addr) if $] == 5.008;
     my @Addresses = Mail::Address->parse($Addr);
     
     my $AddrObj = $Addresses[0];
@@ -382,6 +429,26 @@ sub ParseAddressFromHeader{
 }
 # }}}
 
+# {{{ sub ParseTicketId 
+
+
+sub ParseTicketId {
+    my $Subject = shift;
+    my $id;
+
+    my $test_name = $RT::EmailSubjectTagRegex || qr/\Q$RT::rtname\E/;
+
+    if ( $Subject =~ s/\[$test_name\s+\#(\d+)\s*\]//i ) {
+        my $id = $1;
+        $RT::Logger->debug("Found a ticket ID. It's $id");
+        return ($id);
+    }
+    else {
+        return (undef);
+    }
+}
+
+# }}}
 
 
 =head2 Gateway ARGSREF
@@ -409,11 +476,12 @@ Returns:
 
     status code is a numeric value.
 
-    for temporary failures, status code should be -75
+      for temporary failures, the status code should be -75
 
-    for permanent failures which are handled by RT, status code should be 0
+      for permanent failures which are handled by RT, the status code 
+      should be 0
     
-    for succces, the status code should be 1
+      for succces, the status code should be 1
 
 
 
@@ -425,14 +493,15 @@ sub Gateway {
     my %args = %$argsref;
 
     # Set some reasonable defaults
-    $args{'action'} = 'correspond' unless ( $args{'action'} );
-    $args{'queue'}  = '1'          unless ( $args{'queue'} );
+    $args{'action'} ||= 'correspond';
+    $args{'queue'}  ||= '1';
 
     # Validate the action
-    unless ( $args{'action'} =~ /^(comment|correspond|action)$/ ) {
+    my ($status, @actions) = IsCorrectAction( $args{'action'} );
+    unless ( $status ) {
 
         # Can't safely loc this. What object do we loc around?
-        $RT::Logger->crit("Mail gateway called with an invalid action paramenter '".$args{'action'}."' for queue '".$args{'queue'}."'");
+        $RT::Logger->crit("Mail gateway called with an invalid action paramenter '".$actions[0]."' for queue '".$args{'queue'}."'");
 
         return ( -75, "Invalid 'action' parameter", undef );
     }
@@ -455,21 +524,21 @@ sub Gateway {
     my $Message = $parser->Entity();
     my $head    = $Message->head;
 
-    my ( $CurrentUser, $AuthStat, $status, $error );
+    my ( $CurrentUser, $AuthStat, $error );
 
     # Initalize AuthStat so comparisons work correctly
     $AuthStat = -9999999;
 
     my $ErrorsTo = ParseErrorsToAddressFromHead($head);
 
-    my $MessageId = $head->get('Message-Id')
+    my $MessageId = $head->get('Message-ID')
       || "<no-message-id-" . time . rand(2000) . "\@.$RT::Organization>";
 
     #Pull apart the subject line
     my $Subject = $head->get('Subject') || '';
     chomp $Subject;
 
-    $args{'ticket'} ||= $parser->ParseTicketId($Subject);
+    $args{'ticket'} ||= ParseTicketId($Subject);
 
     my $SystemTicket;
     my $Right = 'CreateTicket';
@@ -519,22 +588,28 @@ sub Gateway {
             }
         }
 
-        ( $CurrentUser, $NewAuthStat ) = $Code->(
-            Message     => $Message,
-            RawMessageRef => \$args{'message'},
-            CurrentUser => $CurrentUser,
-            AuthLevel   => $AuthStat,
-            Action      => $args{'action'},
-            Ticket      => $SystemTicket,
-            Queue       => $SystemQueueObj
-        );
+	foreach my $action ( @actions ) {
+
+            ( $CurrentUser, $NewAuthStat ) = $Code->(
+                Message     => $Message,
+                RawMessageRef => \$args{'message'},
+                CurrentUser => $CurrentUser,
+                AuthLevel   => $AuthStat,
+                Action      => $action,
+                Ticket      => $SystemTicket,
+                Queue       => $SystemQueueObj
+            );
+
 
+            # If a module returns a "-1" then we discard the ticket, so.
+            $AuthStat = -1 if $NewAuthStat == -1;
 
-        # If a module returns a "-1" then we discard the ticket, so.
-        $AuthStat = -1 if $NewAuthStat == -1;
+            # You get the highest level of authentication you were assigned.
+            $AuthStat = $NewAuthStat if $NewAuthStat > $AuthStat;
+
+            last if $AuthStat == -1;
+	}
 
-        # You get the highest level of authentication you were assigned.
-        $AuthStat = $NewAuthStat if $NewAuthStat > $AuthStat;
         last if $AuthStat == -1;
     }
 
@@ -641,11 +716,15 @@ EOT
     }
 
     if ($SquelchReplies) {
-        ## TODO: This is a hack.  It should be some other way to
-        ## indicate that the transaction should be "silent".
 
+        # Squelch replies to the sender, and also leave a clue to
+        # allow us to squelch ALL outbound messages. This way we
+        # can punt the logic of "what to do when we get a bounce"
+        # to the scrip. We might want to notify nobody. Or just
+        # the RT Owner. Or maybe all Privileged watchers.
         my ( $Sender, $junk ) = ParseSenderAddressFromHead($head);
         $head->add( 'RT-Squelch-Replies-To', $Sender );
+        $head->add( 'RT-DetectedAutoGenerated', 'true' );
     }
 
     # }}}
@@ -653,7 +732,8 @@ EOT
     my $Ticket = RT::Ticket->new($CurrentUser);
 
     # {{{ If we don't have a ticket Id, we're creating a new ticket
-    if ( !$args{'ticket'} ) {
+    if ( (!$SystemTicket || !$SystemTicket->Id) && 
+           grep /^(comment|correspond)$/, @actions ) {
 
         # {{{ Create a new ticket
 
@@ -685,74 +765,115 @@ EOT
             $RT::Logger->error("Create failed: $id / $Transaction / $ErrStr ");
             return ( 0, "Ticket creation failed", $Ticket );
         }
+	# strip comments&corresponds from the actions we don't need record twice
+	@actions = grep !/^(comment|correspond)$/, @actions;
+	$args{'ticket'} = $id;
 
         # }}}
     }
 
-    # }}}
-
-    #   If the action is comment, add a comment.
-    elsif ( $args{'action'} =~ /^(comment|correspond)$/i ) {
-        $Ticket->Load( $args{'ticket'} );
-        unless ( $Ticket->Id ) {
-            my $message = "Could not find a ticket with id " . $args{'ticket'};
-            MailError(
-                To          => $ErrorsTo,
-                Subject     => "Message not recorded",
-                Explanation => $message,
-                MIMEObj     => $Message
-            );
+    $Ticket->Load( $args{'ticket'} );
+    unless ( $Ticket->Id ) {
+        my $message = "Could not find a ticket with id " . $args{'ticket'};
+        MailError(
+            To          => $ErrorsTo,
+            Subject     => "Message not recorded",
+            Explanation => $message,
+            MIMEObj     => $Message
+        );
+    
+        return ( 0, $message );
+    }
 
-            return ( 0, $message );
+    # }}}
+    foreach my $action( @actions ) {
+        #   If the action is comment, add a comment.
+        if ( $action =~ /^(comment|correspond)$/i ) {
+            my ( $status, $msg );
+            if ( $action =~ /^correspond$/i ) {
+                ( $status, $msg ) = $Ticket->Correspond( MIMEObj => $Message );
+            }
+            else {
+                ( $status, $msg ) = $Ticket->Comment( MIMEObj => $Message );
+            }
+            unless ($status) {
+    
+                #Warn the sender that we couldn't actually submit the comment.
+                MailError(
+                    To          => $ErrorsTo,
+                    Subject     => "Message not recorded",
+                    Explanation => $msg,
+                    MIMEObj     => $Message
+                );
+                return ( 0, "Message not recorded", $Ticket );
+            }
         }
-
-        my ( $status, $msg );
-        if ( $args{'action'} =~ /^correspond$/ ) {
-            ( $status, $msg ) = $Ticket->Correspond( MIMEObj => $Message );
+        elsif ($RT::UnsafeEmailCommands && $action =~ /^take$/i ) {
+            my ( $status, $msg ) = $Ticket->SetOwner( $CurrentUser->id );
+            unless ($status) {
+    
+                #Warn the sender that we couldn't actually submit the comment.
+                MailError(
+                    To          => $ErrorsTo,
+                    Subject     => "Ticket not taken",
+                    Explanation => $msg,
+                    MIMEObj     => $Message
+                );
+                return ( 0, "Ticket not taken", $Ticket );
+            }
         }
-        else {
-            ( $status, $msg ) = $Ticket->Comment( MIMEObj => $Message );
+        elsif ( $RT::UnsafeEmailCommands && $action =~ /^resolve$/i ) {
+            my ( $status, $msg ) = $Ticket->SetStatus( 'resolved' );
+            unless ($status) {
+                #Warn the sender that we couldn't actually submit the comment.
+                MailError(
+                    To          => $ErrorsTo,
+                    Subject     => "Ticket not resolved",
+                    Explanation => $msg,
+                    MIMEObj     => $Message
+                );
+                return ( 0, "Ticket not resolved", $Ticket );
+            }
         }
-        unless ($status) {
-
-            #Warn the sender that we couldn't actually submit the comment.
+    
+        else {
+    
+            #Return mail to the sender with an error
             MailError(
                 To          => $ErrorsTo,
-                Subject     => "Message not recorded",
-                Explanation => $msg,
-                MIMEObj     => $Message
+                Subject     => "RT Configuration error",
+                Explanation => "'"
+                  . $args{'action'}
+                  . "' not a recognized action."
+                  . " Your RT administrator has misconfigured "
+                  . "the mail aliases which invoke RT",
+                MIMEObj => $Message
+            );
+            $RT::Logger->crit( $args{'action'} . " type unknown for $MessageId" );
+            return (
+                -75,
+                "Configuration error: "
+                  . $args{'action'}
+                  . " not a recognized action",
+                $Ticket
             );
-            return ( 0, "Message not recorded", $Ticket );
+    
         }
     }
 
-    else {
-
-        #Return mail to the sender with an error
-        MailError(
-            To          => $ErrorsTo,
-            Subject     => "RT Configuration error",
-            Explanation => "'"
-              . $args{'action'}
-              . "' not a recognized action."
-              . " Your RT administrator has misconfigured "
-              . "the mail aliases which invoke RT",
-            MIMEObj => $Message
-        );
-        $RT::Logger->crit( $args{'action'} . " type unknown for $MessageId" );
-        return (
-            -75,
-            "Configuration error: "
-              . $args{'action'}
-              . " not a recognized action",
-            $Ticket
-        );
-
-    }
-
     return ( 1, "Success", $Ticket );
 }
 
+sub IsCorrectAction
+{
+	my $action = shift;
+	my @actions = split /-/, $action;
+	foreach ( @actions ) {
+		return (0, $_) unless /^(?:comment|correspond|take|resolve)$/;
+	}
+	return (1, @actions);
+}
+
 
 eval "require RT::Interface::Email_Vendor";
 die $@ if ($@ && $@ !~ qr{^Can't locate RT/Interface/Email_Vendor.pm});
diff --git a/rt/lib/RT/Interface/Email/Auth/GnuPG.pm b/rt/lib/RT/Interface/Email/Auth/GnuPG.pm
index 724b1b3fc..2dfada755 100755
--- a/rt/lib/RT/Interface/Email/Auth/GnuPG.pm
+++ b/rt/lib/RT/Interface/Email/Auth/GnuPG.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,7 +42,7 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 #
 package RT::Interface::Email::Auth::GnuPG;
 use Mail::GnuPG;
diff --git a/rt/lib/RT/Interface/Email/Auth/MailFrom.pm b/rt/lib/RT/Interface/Email/Auth/MailFrom.pm
index 0efadb1cd..ef315dd53 100644
--- a/rt/lib/RT/Interface/Email/Auth/MailFrom.pm
+++ b/rt/lib/RT/Interface/Email/Auth/MailFrom.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,7 +42,7 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 package RT::Interface::Email::Auth::MailFrom;
 use RT::Interface::Email qw(ParseSenderAddressFromHead CreateUser);
 
@@ -122,6 +122,36 @@ sub GetCurrentUser {
             }
 
         }
+        elsif ( $args{'Action'} =~ /^take$/i ) {
+
+            # check to see whether "Everybody" or "Unprivileged users" can correspond on tickets
+            unless ( $everyone->PrincipalObj->HasRight(Object => $args{'Queue'},
+                                                       Right  => 'OwnTicket'
+                     )
+                     || $unpriv->PrincipalObj->HasRight(
+                                                       Object => $args{'Queue'},
+                                                       Right  => 'OwnTicket'
+                     )
+              ) {
+                return ( $args{'CurrentUser'}, 0 );
+            }
+
+        }
+        elsif ( $args{'Action'} =~ /^resolve$/i ) {
+
+            # check to see whether "Everybody" or "Unprivileged users" can correspond on tickets
+            unless ( $everyone->PrincipalObj->HasRight(Object => $args{'Queue'},
+                                                       Right  => 'ModifyTicket'
+                     )
+                     || $unpriv->PrincipalObj->HasRight(
+                                                       Object => $args{'Queue'},
+                                                       Right  => 'ModifyTicket'
+                     )
+              ) {
+                return ( $args{'CurrentUser'}, 0 );
+            }
+
+        }
         else {
             return ( $args{'CurrentUser'}, 0 );
         }
diff --git a/rt/lib/RT/Interface/Email/Filter/SpamAssassin.pm b/rt/lib/RT/Interface/Email/Filter/SpamAssassin.pm
index 8c9eae88c..c552d76e6 100644
--- a/rt/lib/RT/Interface/Email/Filter/SpamAssassin.pm
+++ b/rt/lib/RT/Interface/Email/Filter/SpamAssassin.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,22 +42,31 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 package RT::Interface::Email::Filter::SpamAssassin;
 
 use Mail::SpamAssassin;
 my $spamtest = Mail::SpamAssassin->new();
 
 sub GetCurrentUser {
-    my $item = shift;
-    my $status = $spamtest->check ($item);
-    return (undef, 0) unless $status->is_spam();
+    my %args = (
+        Message     => undef,
+        CurrentUser => undef,
+        AuthLevel   => undef,
+        @_
+    );
+    my $status = $spamtest->check( $args{'Message'} );
+    return ( $args{'CurrentUser'}, $args{'AuthLevel'} )
+      unless $status->is_spam();
+
     eval { $status->rewrite_mail() };
-    if ($status->get_hits > $status->get_required_hits()*1.5) { 
+    if ( $status->get_hits > $status->get_required_hits() * 1.5 ) {
+
         # Spammy indeed
-        return (undef, -1);
+        return ( $args{'CurrentUser'}, -1 );
     }
-    return (undef, 0);
+    return ( $args{'CurrentUser'}, $args{'AuthLevel'} );
+
 }
 
 =head1 NAME
diff --git a/rt/lib/RT/Interface/REST.pm b/rt/lib/RT/Interface/REST.pm
index 8c8baa1e7..279ddf4b3 100644
--- a/rt/lib/RT/Interface/REST.pm
+++ b/rt/lib/RT/Interface/REST.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,7 +42,7 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 # lib/RT/Interface/REST.pm
 #
 
@@ -54,7 +54,7 @@ BEGIN {
     use Exporter ();
     use vars qw($VERSION @ISA @EXPORT);
 
-    $VERSION = do { my @r = (q$Revision: 1.1.1.2 $ =~ /\d+/g); sprintf "%d."."%02d"x$#r, @r };
+    $VERSION = do { my @r = (q$Revision: 1.1.1.3 $ =~ /\d+/g); sprintf "%d."."%02d"x$#r, @r };
 
     @ISA = qw(Exporter);
     @EXPORT = qw(expand_list form_parse form_compose vpush vsplit);
diff --git a/rt/lib/RT/Interface/Web.pm b/rt/lib/RT/Interface/Web.pm
index 0151cc1f1..724d7e592 100644
--- a/rt/lib/RT/Interface/Web.pm
+++ b/rt/lib/RT/Interface/Web.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,7 +42,7 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
 ## Portions Copyright 2000 Tobias Brox <tobix@fsck.com>
 
 ## This is a library of static subs to be used by the Mason web
@@ -77,6 +77,7 @@ does a css-busting but minimalist escaping of whatever html you're passing in.
 
 sub EscapeUTF8  {
         my  $ref = shift;
+        return unless defined $$ref;
         my $val = $$ref;
         use bytes;
         $val =~ s/&/&#38;/g;
@@ -94,6 +95,24 @@ sub EscapeUTF8  {
 
 # }}}
 
+# {{{ EscapeURI
+
+=head2 EscapeURI SCALARREF
+
+Escapes URI component according to RFC2396
+
+=cut
+
+use Encode qw();
+sub EscapeURI {
+    my $ref = shift;
+    $$ref = Encode::encode_utf8( $$ref );
+    $$ref =~ s/([^a-zA-Z0-9_.!~*'()-])/uc sprintf("%%%02X", ord($1))/eg;
+    Encode::_utf8_on( $$ref );
+}
+
+# }}}
+
 # {{{ WebCanonicalizeInfo
 
 =head2 WebCanonicalizeInfo();
@@ -292,17 +311,42 @@ sub CreateTicket {
         Starts          => $starts->ISO,
         MIMEObj         => $MIMEObj
     );
-    foreach my $arg (%ARGS) {
-        if ($arg =~ /^CustomField-(\d+)(.*?)$/) {
+    foreach my $arg (keys %ARGS) {
+            my $cfid = $1;
+
             next if ($arg =~ /-Magic$/);
-            $create_args{"CustomField-".$1} = $ARGS{"$arg"};
+       #Object-RT::Ticket--CustomField-3-Values
+        if ($arg =~ /^Object-RT::Transaction--CustomField-/) {
+            $create_args{$arg} = $ARGS{$arg};
+        }
+        elsif ($arg =~ /^Object-RT::Ticket--CustomField-(\d+)(.*?)$/) {
+            my $cfid = $1;
+            my $cf = RT::CustomField->new( $session{'CurrentUser'});
+            $cf->Load($cfid);
+
+            if ( $cf->Type eq 'Freeform' && ! $cf->SingleValue) {
+                $ARGS{$arg} =~ s/\r\n/\n/g;
+                $ARGS{$arg} = [split('\n', $ARGS{$arg})];
+            }
+
+            if ( $cf->Type =~ /text/i) { # Catch both Text and Wikitext
+                $ARGS{$arg} =~ s/\r//g;
+            }
+
+            if ( $arg =~ /-Upload$/ ) {
+                $create_args{"CustomField-".$cfid} = _UploadedFile($arg);
+            }
+            else {
+                $create_args{"CustomField-".$cfid} = $ARGS{"$arg"};
+            }
         }
     }
 
-    # turn new link lists into arrays, and pass in the proper arguments
-    my (@dependson, @dependedonby, 
-	@parents, @children, 
-	@refersto, @referredtoby);
+
+    # XXX TODO This code should be about six lines. and badly needs refactoring.
+ 
+    # {{{ turn new link lists into arrays, and pass in the proper arguments
+    my (@dependson, @dependedonby, @parents, @children, @refersto, @referredtoby);
 
     foreach my $luri ( split ( / /, $ARGS{"new-DependsOn"} ) ) {
 	$luri =~ s/\s*$//;    # Strip trailing whitespace
@@ -336,7 +380,9 @@ sub CreateTicket {
 	push @referredtoby, $luri;
     }
     $create_args{'ReferredToBy'} = \@referredtoby;
-
+    # }}}
+  
+ 
     my ( $id, $Trans, $ErrMsg ) = $Ticket->Create(%create_args);
     unless ( $id && $Trans ) {
         Abort($ErrMsg);
@@ -398,9 +444,10 @@ sub ProcessUpdateMessage {
     );
 
     #Make the update content have no 'weird' newlines in it
-    if ( $args{ARGSRef}->{'UpdateTimeWorked'} ||
-	 $args{ARGSRef}->{'UpdateContent'} ||
-	 $args{ARGSRef}->{'UpdateAttachments'}) {
+    if (   $args{ARGSRef}->{'UpdateTimeWorked'}
+        || $args{ARGSRef}->{'UpdateContent'}
+        || $args{ARGSRef}->{'UpdateAttachments'} )
+    {
 
         if (
             $args{ARGSRef}->{'UpdateSubject'} eq $args{'TicketObj'}->Subject() )
@@ -409,43 +456,76 @@ sub ProcessUpdateMessage {
         }
 
         my $Message = MakeMIMEEntity(
-            Subject             => $args{ARGSRef}->{'UpdateSubject'},
-            Body                => $args{ARGSRef}->{'UpdateContent'},
+            Subject => $args{ARGSRef}->{'UpdateSubject'},
+            Body    => $args{ARGSRef}->{'UpdateContent'},
         );
 
-        if ($args{ARGSRef}->{'UpdateAttachments'}) {
-            $Message->make_multipart;
-            $Message->add_part($_) foreach values %{$args{ARGSRef}->{'UpdateAttachments'}};
-        }
-
-        ## TODO: Implement public comments
-        if ( $args{ARGSRef}->{'UpdateType'} =~ /^(private|public)$/ ) {
-            my ( $Transaction, $Description, $Object ) = $args{TicketObj}->Comment(
-                CcMessageTo  => $args{ARGSRef}->{'UpdateCc'},
-                BccMessageTo => $args{ARGSRef}->{'UpdateBcc'},
-                MIMEObj      => $Message,
-                TimeTaken    => $args{ARGSRef}->{'UpdateTimeWorked'}
-            );
-            push ( @{ $args{Actions} }, $Description );
-        }
-        elsif ( $args{ARGSRef}->{'UpdateType'} eq 'response' ) {
-            my ( $Transaction, $Description, $Object ) = $args{TicketObj}->Correspond(
-                CcMessageTo  => $args{ARGSRef}->{'UpdateCc'},
-                BccMessageTo => $args{ARGSRef}->{'UpdateBcc'},
-                MIMEObj      => $Message,
-                TimeTaken    => $args{ARGSRef}->{'UpdateTimeWorked'}
-            );
-            push ( @{ $args{Actions} }, $Description );
+        $Message->head->add( 'Message-ID' => 
+              "<rt-"
+              . $RT::VERSION . "-"
+              . $$ . "-"
+              . CORE::time() . "-"
+              . int(rand(2000)) . "."
+              . $args{'TicketObj'}->id . "-"
+              . "0" . "-"  # Scrip
+              . "0" . "@"  # Email sent
+              . $RT::Organization
+              . ">" );
+        my $old_txn = RT::Transaction->new( $session{'CurrentUser'} );
+        if ( $args{ARGSRef}->{'QuoteTransaction'} ) {
+            $old_txn->Load( $args{ARGSRef}->{'QuoteTransaction'} );
         }
         else {
-            push ( @{ $args{'Actions'} },
-                loc("Update type was neither correspondence nor comment.").
-                " ".
-                loc("Update not recorded.")
-            );
+            $old_txn = $args{TicketObj}->Transactions->First();
         }
+
+        if ( $old_txn->Message && $old_txn->Message->First ) {
+            my @in_reply_to = split(/\s+/m, $old_txn->Message->First->GetHeader('In-Reply-To') || '');  
+            my @references = split(/\s+/m, $old_txn->Message->First->GetHeader('References') || '' );  
+            my @msgid = split(/\s+/m,$old_txn->Message->First->GetHeader('Message-ID') || ''); 
+            my @rtmsgid = split(/\s+/m,$old_txn->Message->First->GetHeader('RT-Message-ID') || ''); 
+
+            $Message->head->replace( 'In-Reply-To', join (' ', @rtmsgid ? @rtmsgid : @msgid));
+            $Message->head->replace( 'References', join(' ', @references, @msgid, @rtmsgid));
+        }
+
+    if ( $args{ARGSRef}->{'UpdateAttachments'} ) {
+        $Message->make_multipart;
+        $Message->add_part($_)
+          foreach values %{ $args{ARGSRef}->{'UpdateAttachments'} };
+    }
+
+    ## TODO: Implement public comments
+    if ( $args{ARGSRef}->{'UpdateType'} =~ /^(private|public)$/ ) {
+        my ( $Transaction, $Description, $Object ) = $args{TicketObj}->Comment(
+            CcMessageTo  => $args{ARGSRef}->{'UpdateCc'},
+            BccMessageTo => $args{ARGSRef}->{'UpdateBcc'},
+            MIMEObj      => $Message,
+            TimeTaken    => $args{ARGSRef}->{'UpdateTimeWorked'}
+        );
+        push( @{ $args{Actions} }, $Description );
+        $Object->UpdateCustomFields( ARGSRef => $args{ARGSRef} ) if $Object;
+    }
+    elsif ( $args{ARGSRef}->{'UpdateType'} eq 'response' ) {
+        my ( $Transaction, $Description, $Object ) =
+          $args{TicketObj}->Correspond(
+            CcMessageTo  => $args{ARGSRef}->{'UpdateCc'},
+            BccMessageTo => $args{ARGSRef}->{'UpdateBcc'},
+            MIMEObj      => $Message,
+            TimeTaken    => $args{ARGSRef}->{'UpdateTimeWorked'}
+          );
+        push( @{ $args{Actions} }, $Description );
+        $Object->UpdateCustomFields( ARGSRef => $args{ARGSRef} ) if $Object;
+    }
+    else {
+        push(
+            @{ $args{'Actions'} },
+            loc("Update type was neither correspondence nor comment.") . " "
+              . loc("Update not recorded.")
+        );
     }
 }
+}
 
 # }}}
 
@@ -789,19 +869,6 @@ sub ParseDateToISO {
 
 # }}}
 
-# {{{ sub Config 
-# TODO: This might eventually read the cookies, user configuration
-# information from the DB, queue configuration information from the
-# DB, etc.
-
-sub Config {
-    my $args = shift;
-    my $key  = shift;
-    return $args->{$key} || $RT::WebOptions{$key};
-}
-
-# }}}
-
 # {{{ sub ProcessACLChanges
 
 sub ProcessACLChanges {
@@ -859,7 +926,6 @@ sub ProcessACLChanges {
                 $obj = $object_type->new($session{'CurrentUser'});
                 $obj->Load($object_id);      
             } else {
-		die;
                 push (@results, loc("System Error"). ': '.
                                 loc("Rights could not be revoked for [_1]", $object_type));
                 next;
@@ -1006,7 +1072,10 @@ sub ProcessTicketBasics {
         }
     }
 
-    $ARGSRef->{'Status'} ||= $TicketObj->Status;
+
+   # Status isn't a field that can be set to a null value.
+   # RT core complains if you try
+    delete $ARGSRef->{'Status'} unless ($ARGSRef->{'Status'});
     
     my @results = UpdateRecordObject(
         AttributesRef => \@attribs,
@@ -1036,117 +1105,158 @@ sub ProcessTicketBasics {
 
 # }}}
 
-# {{{ Sub ProcessTicketCustomFieldUpdates
-
 sub ProcessTicketCustomFieldUpdates {
-    my %args = (
-        ARGSRef => undef,
-        @_
-    );
+    my %args = @_;
+    $args{'Object'} = delete $args{'TicketObj'};
+    my $ARGSRef = { %{ $args{'ARGSRef'} } };
 
-    my @results;
+    # Build up a list of objects that we want to work with
+    my %custom_fields_to_mod;
+    foreach my $arg ( keys %$ARGSRef ) {
+        if ( $arg =~ /^Ticket-(\d+-.*)/) {
+	    $ARGSRef->{"Object-RT::Ticket-$1"} = delete $ARGSRef->{$arg};
+	}
+        elsif ( $arg =~ /^CustomField-(\d+-.*)/) {
+	    $ARGSRef->{"Object-RT::Ticket--$1"} = delete $ARGSRef->{$arg};
+	}
+    }
+
+    return ProcessObjectCustomFieldUpdates(%args, ARGSRef => $ARGSRef);
+}
 
+sub ProcessObjectCustomFieldUpdates {
+    my %args = @_;
     my $ARGSRef = $args{'ARGSRef'};
+    my @results;
 
-    # Build up a list of tickets that we want to work with
-    my %tickets_to_mod;
+    # Build up a list of objects that we want to work with
     my %custom_fields_to_mod;
-    foreach my $arg ( keys %{$ARGSRef} ) {
-        if ( $arg =~ /^Ticket-(\d+)-CustomField-(\d+)-/ ) {
-
-            # For each of those tickets, find out what custom fields we want to work with.
-            $custom_fields_to_mod{$1}{$2} = 1;
+    foreach my $arg ( keys %$ARGSRef ) {
+        if ( $arg =~ /^Object-([\w:]+)-(\d*)-CustomField-(\d+)-/ ) {
+            # For each of those objects, find out what custom fields we want to work with.
+            $custom_fields_to_mod{$1}{$2 || $args{'Object'}->Id}{$3} = 1;
         }
     }
 
-    # For each of those tickets
-    foreach my $tick ( keys %custom_fields_to_mod ) {
-        my $Ticket = $args{'TicketObj'};
-	if (!$Ticket or $Ticket->id != $tick) {
-	    $Ticket = RT::Ticket->new( $session{'CurrentUser'} );
-	    $Ticket->Load($tick);
+    # For each of those objects
+    foreach my $class ( keys %custom_fields_to_mod ) {
+	foreach my $id ( keys %{$custom_fields_to_mod{$class}} ) {
+	    my $Object = $args{'Object'};
+	    if (!$Object or ref($Object) ne $class or $Object->id != $id) {
+		$Object = $class->new( $session{'CurrentUser'} );
+		$Object->Load($id);
 	}
 
-        # For each custom field  
-        foreach my $cf ( keys %{ $custom_fields_to_mod{$tick} } ) {
-
+	    # For each custom field  
+	    foreach my $cf ( keys %{ $custom_fields_to_mod{$class}{$id} } ) {
 	    my $CustomFieldObj = RT::CustomField->new($session{'CurrentUser'});
 	    $CustomFieldObj->LoadById($cf);
 
-            foreach my $arg ( keys %{$ARGSRef} ) {
-                # since http won't pass in a form element with a null value, we need
-                # to fake it
-                if ($arg =~ /^(.*?)-Values-Magic$/ ) {
-                    # We don't care about the magic, if there's really a values element;
-                    next if (exists $ARGSRef->{$1.'-Values'}) ;
-
-                    $arg = $1."-Values";
-                    $ARGSRef->{$1."-Values"} = undef;
-                
-                }
-                next unless ( $arg =~ /^Ticket-$tick-CustomField-$cf-/ );
-                my @values =
-                  ( ref( $ARGSRef->{$arg} ) eq 'ARRAY' ) 
-                  ? @{ $ARGSRef->{$arg} }
-                  : split /\n/, $ARGSRef->{$arg} ;
-
-		#for poor windows boxen that pass in "\r\n"
-		local $/ = "\r";
-		chomp @values;
-
-                if ( ( $arg =~ /-AddValue$/ ) || ( $arg =~ /-Value$/ ) ) {
-                    foreach my $value (@values) {
-                        next unless length($value);
-                        my ( $val, $msg ) = $Ticket->AddCustomFieldValue(
-                            Field => $cf,
-                            Value => $value
-                        );
-                        push ( @results, $msg );
-                    }
-                }
-                elsif ( $arg =~ /-DeleteValues$/ ) {
-                    foreach my $value (@values) {
-                        next unless length($value);
-                        my ( $val, $msg ) = $Ticket->DeleteCustomFieldValue(
+		foreach my $arg ( keys %{$ARGSRef} ) {
+		    # Only interested in args for the current CF:
+		    next unless ( $arg =~ /^Object-$class-(?:$id)?-CustomField-$cf-/ );
+
+		    # since http won't pass in a form element with a null value, we need
+		    # to fake it
+		    if ($arg =~ /^(.*?)-Values-Magic$/ ) {
+			# We don't care about the magic, if there's really a values element;
+			next if ($ARGSRef->{$1.'-Value'} || $ARGSRef->{$1.'-Values'}) ;
+
+                        # "Empty" values does not mean anything for Image and Binary fields
+                        next if $CustomFieldObj->Type =~ /^(?:Image|Binary)$/;
+
+			$arg = $1."-Values";
+			$ARGSRef->{$1."-Values"} = undef;
+		    
+		    }
+		    my @values = ();
+		    if (ref( $ARGSRef->{$arg} ) eq 'ARRAY' ) {
+			@values = @{ $ARGSRef->{$arg} };
+		    } elsif ($CustomFieldObj->Type =~ /text/i) { # Both Text and Wikitext
+			@values = ($ARGSRef->{$arg});
+		    } else {
+			@values = split /\n/, $ARGSRef->{$arg};
+		    }
+		    
+		    if ( ($CustomFieldObj->Type eq 'Freeform' 
+			  && ! $CustomFieldObj->SingleValue) ||
+			  $CustomFieldObj->Type =~ /text/i) {
+			foreach my $val (@values) {
+			    $val =~ s/\r//g;
+			}
+		    }
+
+		    if ( ( $arg =~ /-AddValue$/ ) || ( $arg =~ /-Value$/ ) ) {
+			foreach my $value (@values) {
+			    next unless length($value);
+			    my ( $val, $msg ) = $Object->AddCustomFieldValue(
+				Field => $cf,
+				Value => $value
+			    );
+			    push ( @results, $msg );
+			}
+		    }
+		    elsif ( $arg =~ /-Upload$/ ) {
+                        my $value_hash = _UploadedFile($arg) or next;
+
+			my ( $val, $msg ) = $Object->AddCustomFieldValue(
+                            %$value_hash,
                             Field => $cf,
-                            Value => $value
-                        );
-                        push ( @results, $msg );
-                    }
-                }
-                elsif ( $arg =~ /-Values$/ and $CustomFieldObj->Type !~ /Entry/) {
-                    my $cf_values = $Ticket->CustomFieldValues($cf);
-
-                    my %values_hash;
-                    foreach my $value (@values) {
-                        next unless length($value);
-
-                        # build up a hash of values that the new set has
-                        $values_hash{$value} = 1;
-
-                        unless ( $cf_values->HasEntry($value) ) {
-                            my ( $val, $msg ) = $Ticket->AddCustomFieldValue(
-                                Field => $cf,
-                                Value => $value
-                            );
-                            push ( @results, $msg );
-                        }
-
-                    }
-                    while ( my $cf_value = $cf_values->Next ) {
-                        unless ( $values_hash{ $cf_value->Content } == 1 ) {
-                            my ( $val, $msg ) = $Ticket->DeleteCustomFieldValue(
-                                Field => $cf,
-                                Value => $cf_value->Content
-                            );
-                            push ( @results, $msg);
-
-                        }
-
-                    }
-                }
-                elsif ( $arg =~ /-Values$/ ) {
-                    my $cf_values = $Ticket->CustomFieldValues($cf);
+			);
+			push ( @results, $msg );
+		    }
+		    elsif ( $arg =~ /-DeleteValues$/ ) {
+			foreach my $value (@values) {
+			    next unless length($value);
+			    my ( $val, $msg ) = $Object->DeleteCustomFieldValue(
+				Field => $cf,
+				Value => $value
+			    );
+			    push ( @results, $msg );
+			}
+		    }
+		    elsif ( $arg =~ /-DeleteValueIds$/ ) {
+			foreach my $value (@values) {
+			    next unless length($value);
+			    my ( $val, $msg ) = $Object->DeleteCustomFieldValue(
+				Field => $cf,
+				ValueId => $value,
+			    );
+			    push ( @results, $msg );
+			}
+		    }
+		    elsif ( $arg =~ /-Values$/ and !$CustomFieldObj->Repeated) {
+			my $cf_values = $Object->CustomFieldValues($cf);
+
+			my %values_hash;
+			foreach my $value (@values) {
+			    next unless length($value);
+
+			    # build up a hash of values that the new set has
+			    $values_hash{$value} = 1;
+
+			    unless ( $cf_values->HasEntry($value) ) {
+				my ( $val, $msg ) = $Object->AddCustomFieldValue(
+				    Field => $cf,
+				    Value => $value
+				);
+				push ( @results, $msg );
+			    }
+
+			}
+			while ( my $cf_value = $cf_values->Next ) {
+			    unless ( $values_hash{ $cf_value->Content } == 1 ) {
+				my ( $val, $msg ) = $Object->DeleteCustomFieldValue(
+				    Field => $cf,
+				    Value => $cf_value->Content
+				);
+				push ( @results, $msg);
+
+			    }
+			}
+		    }
+		    elsif ( $arg =~ /-Values$/ ) {
+			my $cf_values = $Object->CustomFieldValues($cf);
 
 		    # keep everything up to the point of difference, delete the rest
 		    my $delete_flag;
@@ -1162,24 +1272,23 @@ sub ProcessTicketCustomFieldUpdates {
 
 		    # now add/replace extra things, if any
 		    foreach my $value (@values) {
-			my ( $val, $msg ) = $Ticket->AddCustomFieldValue(
+			    my ( $val, $msg ) = $Object->AddCustomFieldValue(
 			    Field => $cf,
 			    Value => $value
 			);
 			push ( @results, $msg );
 		    }
 		}
-                else {
-                    push ( @results, "User asked for an unknown update type for custom field " . $cf->Name . " for ticket " . $Ticket->id );
-                }
-            }
-        }
-        return (@results);
+		    else {
+			push ( @results, loc("User asked for an unknown update type for custom field [_1] for [_2] object #[_3]", $cf->Name, $class, $Object->id ) );
+		    }
+		}
+	    }
+	    return (@results);
+	}
     }
 }
 
-# }}}
-
 # {{{ sub ProcessTicketWatchers
 
 =head2 ProcessTicketWatchers ( TicketObj => $Ticket, ARGSRef => \%ARGS );
@@ -1333,6 +1442,7 @@ sub ProcessTicketLinks {
     my $Ticket  = $args{'TicketObj'};
     my $ARGSRef = $args{'ARGSRef'};
 
+
     my (@results) = ProcessRecordLinks(RecordObj => $Ticket,
 				       ARGSRef => $ARGSRef);
 
@@ -1402,6 +1512,34 @@ sub ProcessRecordLinks {
     return (@results);
 }
 
+
+=head2 _UploadedFile ( $arg );
+
+Takes a CGI parameter name; if a file is uploaded under that name,
+return a hash reference suitable for AddCustomFieldValue's use:
+C<( Value => $filename, LargeContent => $content, ContentType => $type )>.
+
+Returns C<undef> if no files were uploaded in the C<$arg> field.
+
+=cut
+
+sub _UploadedFile {
+    my $arg = shift;
+    my $cgi_object = $m->cgi_object;
+    my $fh = $cgi_object->upload($arg) or return undef;
+    my $upload_info = $cgi_object->uploadInfo($fh);
+
+    my $filename = "$fh";
+    $filename =~ s#^.*[\\/]##;
+    binmode($fh);
+
+    return {
+        Value => $filename,
+        LargeContent => do { local $/; scalar <$fh> },
+        ContentType => $upload_info->{'Content-Type'},
+    };
+}
+
 eval "require RT::Interface::Web_Vendor";
 die $@ if ($@ && $@ !~ qr{^Can't locate RT/Interface/Web_Vendor.pm});
 eval "require RT::Interface::Web_Local";
diff --git a/rt/lib/RT/Interface/Web/Handler.pm b/rt/lib/RT/Interface/Web/Handler.pm
index 7ee654e7c..ce9222586 100644
--- a/rt/lib/RT/Interface/Web/Handler.pm
+++ b/rt/lib/RT/Interface/Web/Handler.pm
@@ -1,8 +1,8 @@
-# {{{ BEGIN BPS TAGGED BLOCK
+# BEGIN BPS TAGGED BLOCK {{{
 # 
 # COPYRIGHT:
 #  
-# This software is Copyright (c) 1996-2004 Best Practical Solutions, LLC 
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
 #                                          <jesse@bestpractical.com>
 # 
 # (Except where explicitly superseded by other copyright notices)
@@ -42,9 +42,24 @@
 # works based on those contributions, and sublicense and distribute
 # those contributions and any derivatives thereof.
 # 
-# }}} END BPS TAGGED BLOCK
+# END BPS TAGGED BLOCK }}}
+
 package RT::Interface::Web::Handler;
 
+use CGI qw/-private_tempfiles/;
+use MIME::Entity;
+use Text::Wrapper;
+use CGI::Cookie;
+use Time::ParseDate;
+use Time::HiRes;
+use HTML::Entities;
+use HTML::Scrubber;
+use Text::Quoted;
+use RT::Interface::Web::Handler;
+use File::Path qw( rmtree );
+use File::Glob qw( bsd_glob );
+use File::Spec::Unix;
+
 sub DefaultHandlerArgs  { (
     comp_root => [
         [ local    => $RT::MasonLocalComponentRoot ],
@@ -53,7 +68,10 @@ sub DefaultHandlerArgs  { (
     default_escape_flags => 'h',
     data_dir             => "$RT::MasonDataDir",
     allow_globals        => [qw(%session)],
-    autoflush            => 1
+    # Turn off static source if we're in developer mode.
+    static_source        => ($RT::DevelMode ? '0' : '1'), 
+    use_object_files     => ($RT::DevelMode ? '0' : '1'), 
+    autoflush            => 0
 ) };
 
 # {{{ sub new 
@@ -69,19 +87,17 @@ sub new {
     my $class = shift;
     $class->InitSessionDir;
 
-    if ($MasonX::Apache2Handler::VERSION) {
-        goto &NewApache2Handler;
-    }
-    elsif ($mod_perl::VERSION and $mod_perl::VERSION >= 1.9908) {
-	require Apache::RequestUtil;
-	no warnings 'redefine';
-	my $sub = *Apache::request{CODE};
-	*Apache::request = sub {
-	    my $r;
-	    eval { $r = $sub->('Apache'); };
-	    # warn $@ if $@;
-	    return $r;
-	};
+    if ( $mod_perl::VERSION && $mod_perl::VERSION >= 1.9908 ) {
+#        require Apache::RequestUtil;
+#        no warnings 'redefine';
+#        my $sub = *Apache::request{CODE};
+#        *Apache::request = sub {
+#            my $r;
+#            eval { $r = $sub->('Apache'); };
+#
+#            # warn $@ if $@;
+#            return $r;
+#        };
         goto &NewApacheHandler;
     }
     elsif ($CGI::MOD_PERL) {
@@ -96,14 +112,14 @@ sub InitSessionDir {
     # Activate the following if running httpd as root (the normal case).
     # Resets ownership of all files created by Mason at startup.
     # Note that mysql uses DB for sessions, so there's no need to do this.
-    unless ( $RT::DatabaseType =~ /(mysql|Pg)/ ) {
+    unless ( $RT::DatabaseType =~ /(?:mysql|Pg)/ ) {
 
         # Clean up our umask to protect session files
         umask(0077);
 
         if ($CGI::MOD_PERL) {
             chown( Apache->server->uid, Apache->server->gid,
-                [$RT::MasonSessionDir] )
+                $RT::MasonSessionDir )
             if Apache->server->can('uid');
         }
 
@@ -170,9 +186,36 @@ sub NewHandler {
     );
   
     $handler->interp->set_escape( h => \&RT::Interface::Web::EscapeUTF8 );
+    $handler->interp->set_escape( u => \&RT::Interface::Web::EscapeURI  );
     return($handler);
 }
 
+=head2 CleanupRequest
+
+Rollback any uncommitted transaction.
+Flush the ACL cache
+Flush the searchbuilder query cache
+
+=cut
+
+sub CleanupRequest {
+
+    if ( $RT::Handle->TransactionDepth ) {
+        $RT::Handle->ForceRollback;
+        $RT::Logger->crit(
+            "Transaction not committed. Usually indicates a software fault."
+            . "Data loss may have occurred" );
+    }
+
+    # Clean out the ACL cache. the performance impact should be marginal.
+    # Consistency is imprived, too.
+    RT::Principal->InvalidateACLCache();
+    DBIx::SearchBuilder::Record::Cachable->FlushCache
+      if ( $RT::WebFlushDbCacheEveryRequest
+        and UNIVERSAL::can(
+            'DBIx::SearchBuilder::Record::Cachable' => 'FlushCache' ) );
+
+}
 # }}}
 
 1;
diff --git a/rt/lib/RT/Interface/Web/QueryBuilder.pm b/rt/lib/RT/Interface/Web/QueryBuilder.pm
new file mode 100755
index 000000000..b7526b30a
--- /dev/null
+++ b/rt/lib/RT/Interface/Web/QueryBuilder.pm
@@ -0,0 +1,56 @@
+# BEGIN BPS TAGGED BLOCK {{{
+# 
+# COPYRIGHT:
+#  
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
+#                                          <jesse@bestpractical.com>
+# 
+# (Except where explicitly superseded by other copyright notices)
+# 
+# 
+# LICENSE:
+# 
+# This work is made available to you under the terms of Version 2 of
+# the GNU General Public License. A copy of that license should have
+# been provided with this software, but in any event can be snarfed
+# from www.gnu.org.
+# 
+# This work is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+# 
+# 
+# CONTRIBUTION SUBMISSION POLICY:
+# 
+# (The following paragraph is not intended to limit the rights granted
+# to you to modify and distribute this software under the terms of
+# the GNU General Public License and is only of importance to you if
+# you choose to contribute your changes and enhancements to the
+# community by submitting them to Best Practical Solutions, LLC.)
+# 
+# By intentionally submitting any modifications, corrections or
+# derivatives to this work, or any other work intended for use with
+# Request Tracker, to Best Practical Solutions, LLC, you confirm that
+# you are the copyright holder for those contributions and you grant
+# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
+# royalty-free, perpetual, license to use, copy, create derivative
+# works based on those contributions, and sublicense and distribute
+# those contributions and any derivatives thereof.
+# 
+# END BPS TAGGED BLOCK }}}
+package RT::Interface::Web::QueryBuilder;
+
+use strict;
+use warnings;
+
+eval "require RT::Interface::Web::QueryBuilder_Vendor";
+die $@ if ($@ && $@ !~ qr{^Can't locate RT/Interface/Web/QueryBuilder_Vendor.pm});
+eval "require RT::Interface::Web::QueryBuilder_Local";
+die $@ if ($@ && $@ !~ qr{^Can't locate RT/Interface/Web/QueryBuilder_Local.pm});
+
+1;
diff --git a/rt/lib/RT/Interface/Web/QueryBuilder/Tree.pm b/rt/lib/RT/Interface/Web/QueryBuilder/Tree.pm
new file mode 100755
index 000000000..67b728339
--- /dev/null
+++ b/rt/lib/RT/Interface/Web/QueryBuilder/Tree.pm
@@ -0,0 +1,245 @@
+# BEGIN BPS TAGGED BLOCK {{{
+# 
+# COPYRIGHT:
+#  
+# This software is Copyright (c) 1996-2005 Best Practical Solutions, LLC 
+#                                          <jesse@bestpractical.com>
+# 
+# (Except where explicitly superseded by other copyright notices)
+# 
+# 
+# LICENSE:
+# 
+# This work is made available to you under the terms of Version 2 of
+# the GNU General Public License. A copy of that license should have
+# been provided with this software, but in any event can be snarfed
+# from www.gnu.org.
+# 
+# This work is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+# 
+# 
+# CONTRIBUTION SUBMISSION POLICY:
+# 
+# (The following paragraph is not intended to limit the rights granted
+# to you to modify and distribute this software under the terms of
+# the GNU General Public License and is only of importance to you if
+# you choose to contribute your changes and enhancements to the
+# community by submitting them to Best Practical Solutions, LLC.)
+# 
+# By intentionally submitting any modifications, corrections or
+# derivatives to this work, or any other work intended for use with
+# Request Tracker, to Best Practical Solutions, LLC, you confirm that
+# you are the copyright holder for those contributions and you grant
+# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
+# royalty-free, perpetual, license to use, copy, create derivative
+# works based on those contributions, and sublicense and distribute
+# those contributions and any derivatives thereof.
+# 
+# END BPS TAGGED BLOCK }}}
+package RT::Interface::Web::QueryBuilder::Tree;
+
+use strict;
+use warnings;
+
+use base qw/Tree::Simple/;
+
+=head1 NAME
+
+  RT::Interface::Web::QueryBuilder::Tree - subclass of Tree::Simple used in Query Builder
+
+=head1 DESCRIPTION
+
+This class provides support functionality for the Query Builder (Search/Build.html).
+It is a subclass of L<Tree::Simple>.
+
+=head1 METHODS
+
+=head2 TraversePrePost PREFUNC POSTFUNC
+
+Traverses the tree depth-first.  Before processing the node's children,
+calls PREFUNC with the node as its argument; after processing all of the
+children, calls POSTFUNC with the node as its argument.
+
+(Note that unlike Tree::Simple's C<traverse>, it actually calls its functions
+on the root node passed to it.)
+
+=cut
+
+sub TraversePrePost {
+   my ($self, $prefunc, $postfunc) = @_;
+
+   $prefunc->($self);
+   
+   foreach my $child ($self->getAllChildren()) { 
+           $child->TraversePrePost($prefunc, $postfunc);
+   }
+   
+   $postfunc->($self);
+}
+
+=head2 GetReferencedQueues
+
+Returns a hash reference with keys each queue name referenced in a clause in
+the key (even if it's "Queue != 'Foo'"), and values all 1.
+
+=cut
+
+sub GetReferencedQueues {
+    my $self = shift;
+
+    my $queues = {};
+
+    $self->traverse(
+        sub {
+            my $node = shift;
+
+            return if $node->isRoot;
+
+            my $clause = $node->getNodeValue();
+         
+            if ( ref($clause) and $clause->{Key} eq 'Queue' ) {
+                $queues->{ $clause->{Value} } = 1;
+            };
+        }
+    );
+
+    return $queues;
+}
+
+=head2 GetQueryAndOptionList SELECTED_NODES
+
+Given an array reference of tree nodes that have been selected by the user,
+traverses the tree and returns the equivalent SQL query and a list of hashes
+representing the "clauses" select option list.  Each has contains the keys
+TEXT, INDEX, SELECTED, and DEPTH.  TEXT is the displayed text of the option
+(including parentheses, not including indentation); INDEX is the 0-based
+index of the option in the list (also used as its CGI parameter); SELECTED
+is either 'SELECTED' or '', depending on whether the node corresponding
+to the select option was in the SELECTED_NODES list; and DEPTH is the
+level of indentation for the option.
+
+=cut 
+
+sub GetQueryAndOptionList {
+    my $self           = shift;
+    my $selected_nodes = shift;
+
+    my $optionlist = [];
+
+    my $i = 0;
+
+    $self->TraversePrePost(
+        sub { # This is called before recursing to the node's children.
+            my $node = shift;
+
+            return if $node->isRoot or $node->getParent->isRoot;
+
+            my $clause = $node->getNodeValue();
+            my $str = ' ';
+            my $aggregator_context = $node->getParent()->getNodeValue();
+            $str = $aggregator_context . " " if $node->getIndex() > 0;
+
+            if ( ref($clause) ) { # ie, it's a leaf              
+                $str .=
+                  $clause->{Key} . " " . $clause->{Op} . " " . $clause->{Value};
+            }
+
+            unless ($node->getParent->getParent->isRoot) {
+        #        used to check !ref( $parent->getNodeValue() ) )
+                if ( $node->getIndex() == 0 ) {
+                    $str = '( ' . $str;
+                }
+            }
+
+            push @$optionlist, {
+                TEXT     => $str,
+                INDEX    => $i,
+                SELECTED => (grep { $_ == $node } @$selected_nodes) ? 'SELECTED' : '',
+                DEPTH    => $node->getDepth() - 1,
+            };
+
+            $i++;
+        }, sub {
+            # This is called after recursing to the node's children.
+            my $node = shift;
+
+            return if $node->isRoot or $node->getParent->isRoot or $node->getParent->getParent->isRoot;
+
+            # Only do this for the rightmost child.
+            return unless $node->getIndex == $node->getParent->getChildCount - 1;
+
+            $optionlist->[-1]{TEXT} .= ' )';
+        }
+    );
+
+    return (join ' ', map { $_->{TEXT} } @$optionlist), $optionlist;
+}
+
+=head2 PruneChildLessAggregators
+
+If tree manipulation has left it in a state where there are ANDs, ORs,
+or parenthesizations with no children, get rid of them.
+
+=cut
+
+sub PruneChildlessAggregators {
+    my $self = shift;
+
+    $self->TraversePrePost(
+        sub {
+        },
+        sub {
+            my $node = shift;
+
+            return if $node->isRoot or $node->getParent->isRoot;
+            
+            # We're only looking for aggregators (AND/OR)
+            return if ref $node->getNodeValue;
+            
+            return if $node->getChildCount != 0;
+            
+            # OK, this is a childless aggregator.  Remove self.
+            
+            $node->getParent->removeChild($node);
+            
+            # Deal with circular refs
+            $node->DESTROY;
+        }
+    );
+}
+
+=head2 GetDisplayedNodes
+
+This function returns a list of the nodes of the tree in depth-first
+order which correspond to options in the "clauses" multi-select box.
+In fact, it's all of them but the root and its child.
+
+=cut
+
+sub GetDisplayedNodes {
+    my $self = shift;
+    my @lines;
+
+    $self->traverse(sub {
+        my $node = shift;
+
+        push @lines, $node unless $node->isRoot or $node->getParent->isRoot;
+    });
+
+    return @lines;
+}
+
+
+eval "require RT::Interface::Web::QueryBuilder::Tree_Vendor";
+die $@ if ($@ && $@ !~ qr{^Can't locate RT/Interface/Web/QueryBuilder/Tree_Vendor.pm});
+eval "require RT::Interface::Web::QueryBuilder::Tree_Local";
+die $@ if ($@ && $@ !~ qr{^Can't locate RT/Interface/Web/QueryBuilder/Tree_Local.pm});
+
+1;
diff --git a/rt/lib/RT/Interface/Web/Standalone.pm b/rt/lib/RT/Interface/Web/Standalone.pm
new file mode 100755
index 000000000..bc2423e6d
--- /dev/null
+++ b/rt/lib/RT/Interface/Web/Standalone.pm
@@ -0,0 +1,37 @@
+package RT::Interface::Web::Standalone;
+
+use strict;
+use base 'HTTP::Server::Simple::Mason';
+use RT::Interface::Web::Handler;
+use RT::Interface::Web;
+
+sub handler_class { "RT::Interface::Web::Handler" }
+
+sub setup_escapes {
+    my $self = shift;
+    my $handler = shift;
+
+    # Override HTTP::Server::Simple::Mason's version of this method to do
+    # nothing.  (RT::Interface::Web::Handler does this already for us in
+    # NewHandler.)
+} 
+
+sub default_mason_config {
+    return @RT::MasonParameters;
+} 
+
+sub handle_request {
+
+    my $self = shift;
+    my $cgi = shift;
+
+    Module::Refresh->refresh if $RT::DevelMode;
+
+    $self->SUPER::handle_request($cgi);
+    $RT::Logger->crit($@) if ($@);
+
+    RT::Interface::Web::Handler->CleanupRequest();
+
+}
+
+1;