| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| layout.diff | Add Debian layout (FHS-compatible) | Stephen Quinney <sjq@debian.org> | not-needed | 2013-03-24 | ||
| sitemodules.diff | Use RT_SiteModules.pm in lib/RT/Interface/Web/Handler.pm | Stephen Quinney <sjq@debian.org> | not-needed | 2013-03-24 | ||
| rt_setup_database_upgrade_basedir.diff | Fix relative references to config path | Dominic Hargreaves <dom@earth.li> | not-needed | debian upstream | 2013-03-24 | |
| no_testdeps.diff | Don't run the testdeps portion of configuration | <gerardo@anneke.gerardo.com.ve> | not-needed | 2013-03-24 | ||
| debianize_backup_docs.diff | Customise backup docs for Debian | Dominic Hargreaves <dom@earth.li> | not-needed | 2013-03-27 | ||
| debianize_docs_local.diff | Reference correct local directory for Debian | Dominic Hargreaves <dom@earth.li> | not-needed | 2013-03-27 | ||
| no_test_web_installer.diff | Don't test the web installer The following undiagnosed test failure in the Debian minimal build environment occurs: # Failed test 'no warnings' # at lib/RT/Test.pm line 1611. # There were 2 warning(s) # Previous test 22 'set admin email' # There is no form with the requested fields at t/web/installer.t line 80 # at /usr/share/perl5/WWW/Mechanize.pm line 2745 # WWW::Mechanize::_warn('There is no form with the requested fields') called at /usr/share/perl5/WWW/Mechanize.pm line 2723 # WWW::Mechanize::warn('RT::Test::Web=HASH(0x586d0f0)', 'There is no form with the requested fields') called at /usr/share/perl5/WWW/Mechanize.pm line 1371 However the web installer is not used in the Debian package, so don't run the test. |
Dominic Hargreaves <dom@earth.li> | no | 2013-06-02 | ||
| fix_lintian_privacy_break_logo_error.diff | Don't include remote image references or redirects in broken install page This fixes the lintian error privacy-breach-logo |
Dominic Hargreaves <dom@earth.li> | no | 2014-02-16 | ||
| debianize_UPGRADING-4.2.diff | Debianize UPGRADING-4.2 | Dominic Hargreaves <dom@earth.li> | not-needed | 2014-02-23 | ||
| assettracker-sysgroups.diff | Fix upgrade problems caused by an RTx::AssetTracker installation bug The setup of the wheezy rt4-extension-assettracker package (RTx::AssetTracker 2.0.0b2) accidentally inserted two pairs of system role accounts, causing upgrade failures on SQLite backends due to uniqueness constraint violations. |
Niko Tyni <ntyni@debian.org> | no | debian | 2014-12-27 | |
| load_rt_generated.diff | Load RT::Generated directly from @INC This allows for the possibility of overriding RT::Generated in test scenarios. |
Dominic Hargreaves <dom@earth.li> | no | 2015-05-06 | ||
| rt_test_db_type.diff | Allow overriding DatabaseType from the environment in RT::Test | Dominic Hargreaves <dom@earth.li> | no | 2015-05-07 | ||
| debianize_version.diff | Extract the correct (Debian) version number in configure.ac Also make clear in the web interface that this version number is from Debian. |
Dominic Hargreaves <dom@earth.li> | no | 2015-12-31 | ||
| fonts_use_noto_sans.diff | Use Noto Sans instead of Droid Sans Droid Sans is deprecated in Debian, and we are using the fonts from Debian rather than bundled with RT. |
Dominic Hargreaves <dom@earth.li> | no | debian | 2016-01-01 | |
| test_locale.diff | set LC_ALL to C LANG overrides only not set LC_variables, so if LC_CTYPE is set in the environment, it persists and tons of tests fail. |
gregor herrmann <gregoa@debian.org> | no | vendor | 2016-10-11 | |
| use_cpanel_json_xs.diff | Force the use of Cpanel::JSON::XS JSON::XS breaks RT due to the removed from_json/to_json methods and JSON.pm prefers JSON::XS to our preferred implementation Cpanel::JSON::XS by default. |
Dominic Hargreaves <dom@earth.li> | no | debian | 2018-09-09 | |
| fix_privacy_breach_generic.diff | Replace remote inline images with links Fixes lintian warning privacy-breach-generic |
Dominic Hargreaves <dom@earth.li> | no | 2020-03-29 | ||
| fix_pod_rt_munge_attachments.diff | Fix POD for rt-munge-attachments | Dominic Hargreaves <dom@earth.li> | no | 2020-03-29 | ||
| fix_shebang_upgrade_mysql_schema.diff | Fix shebang for Debian policy | Dominic Hargreaves <dom@earth.li> | no | 2020-03-29 | ||
| fix_test_ldap_ipv4.diff | Force use of IPv4 for LDAP test. Net::LDAP::Server::Test binds to IPv6 by default, but Net::LDAP uses 'localhost' which resolves to an IPv4 address. Even when I switched the call to Net::LDAP->new() to use ip6-localhost it failed elsewhere due to RT using 127.0.0.1. |
Andrew Ruthven <andrew@etc.gen.nz> | no | 2020-07-06 | ||
| upstream_4.4-trunk_gpg:_fix_unitialised_warning.diff | Fix uninitialized warnings of $latest_user_main_key for gpg 2.2 $latest_user_main_key is set by USERID_HINT line, which is absent in gpg 2.2 output. |
Aaron Trevena <ast@bestpractical.com> | no | 2020-05-04 | ||
| upstream_4.4-trunk_gpg:_handle_FAILURE_keyword.diff | Handle FAILURE keyword for gpg 2.2 | Aaron Trevena <ast@bestpractical.com> | no | 2020-05-01 | ||
| upstream_4.4-trunk_gpg:_add_gpg.conf.diff | Add gpg.conf for gpg 2.2 so we can specify passphrase in command line The option "pinentry-mode loopback" is invalid in gpg 1.4, so we need to delete the conf file accordingly. |
sunnavy <sunnavy@bestpractical.com> | no | 2020-05-16 | ||
| upstream_4.4-trunk_gpg:_update_warning_message_tests.diff | Update warning message tests for gpg 2.2 | sunnavy <sunnavy@bestpractical.com> | no | 2020-05-15 | ||
| upstream_4.4-trunk_gpg:_dont_override_fingerprint.diff | Don't override fingerprint if it exsits already With gpg 2.2, subkey fingerprints also show up(after mainkeys), thus we need to prevent them from wrongly overridding ones of mainkeys. |
sunnavy <sunnavy@bestpractical.com> | no | 2020-05-16 | ||
| upstream_4.4-trunk_gpg:_make_crypt-gnupg.t_happy.diff | Make t/mail/crypt-gnupg.t happy with gpg 2.2 Besides the differences of returned info from gpg 1.4 and 2.2, the missing passphrase tests are skipped because otherwise the test would hang(probably waiting for passphrase input) |
sunnavy <sunnavy@bestpractical.com> | no | 2020-05-15 | ||
| upstream_4.4-trunk_gpg:_quit_gpg-agent.diff | Quit gpg-agent after tests for gpg 2.2 | sunnavy <sunnavy@bestpractical.com> | no | 2020-05-16 | ||
| upstream_4.4-trunk_gpg:_move_signed_style_with_attachment.eml.diff | Move signed_old_style_with_attachment.eml to emails directory where it belongs to | sunnavy <sunnavy@bestpractical.com> | no | 2020-05-16 | ||
| upstream_4.4-trunk_gpg:_always_use_temp_gpg_homedir.diff | Always use temp gpg homedir to get a cleaner env There are some temporary files(like gpg.conf) created and also other content changes in gpg homedir, using a clean gpg homedir is more robust and could prevent possible conflicts in the future. |
sunnavy <sunnavy@bestpractical.com> | no | 2020-05-16 | ||
| upstream_4.4-trunk_gpg:_add_extra_ignored_keywords.diff | Add extra ignored keywords for gnupg 2.2.x | Aaron Trevena <ast@bestpractical.com> | no | 2020-05-06 | ||
| upstream_4.4-trunk_gpg:_default_cert-digest_algo_SHA256.diff | Default cert-digest-algo from SHA1 to SHA256 Since 2.2.18, SHA1 is not allowed any more, the error message is: third-party key signatures using the SHA1 algorithm are rejected |
sunnavy <sunnavy@bestpractical.com> | no | 2020-05-15 | ||
| upstream_4.4-trunk_cve:_avoid_time_side_channel_attack.diff | Always check password to avoid timing side channel attacks on login page This addresses CVE-2021-38562. |
Dianne Skoll <dianne@bestpractical.com> | not-needed | debian | 2021-01-15 | |
| upstream_4.4.4_cve:_patchset_2022-06-29.diff | Fix two security issues in RT4 * RT is vulnerable to cross-site scripting (XSS) when displaying attachment content with fraudulent content types. This vulnerability is assigned CVE-2022-25802. * RT did not perform full rights checks on accesses to file or image type custom fields, possibly allowing access to these custom fields by users without rights to access to the associated objects (like the ticket it is associated with). |
Best Practical <support@bestpractical.com> | not-needed | 2022-07-03 | ||
| upstream_4.4.4_cve:_patchset_2023-09-26.diff | Fix two security issues in RT. * RT is vulnerable to unvalidated email headers in incoming email and the mail-gateway REST interface. This vulnerability is assigned CVE-2023-41259. * RT is vulnerable to information leakage via response messages returned from requests sent via the mail-gateway REST interface. This vulnerability is assigned CVE-2023-41260. |
Best Practical <support@bestpractical.com> | not-needed | 2023-10-08 | ||
| fix_expired_certs.dif | Update expired certificates and related tests Slightly modified for Debian, as the original patch updated a test which checked for additional output which isn't included in RT 4.4.4. |
sunnavy <sunnavy@bestpractical.com> | not-needed | 2023-08-29 | ||
| upstream_4.4.4_cve:_patchset_2023-09-26-tests.diff | Patches to tests for Security patches for CVE-2023-41259 and CVE-2023-41260 | sunnavy <sunnavy@bestpractical.com> | not-needed | 2023-10-12 |