Better e-mail message display in RT3

Hello,

This is my first posting to this mailing list, so pelase bear the verbosity.

I have been recently investigating the possibility to use RT3 to manage
relatively large support e-mail address. So far things look promising, except
the ugly e-mail display :slight_smile:

I understand having RT display incoming e-mail in pretty format (HTML
formatting, fonts, attachments etc) is definitely not it’s primary purpose,
but there are some things that aren’t looking good. It is however, sometimes
hard to teach customers how to send you good looking mail (that is, plain text
:-).

For example, if the e-mail message contains both text/plain and text/html
parts (which is common for e-mail coming from OutLook Express) RT would
display either part (depending on configuration), and offer the other part for
Download. However, if you display the text part, the text/html part offered
for download is not sent to the browser with the proper MIME type, but with
text/plain instead - which prevents the browser from displaying the HTML
content.

Where is this handled and has someone worked on prettyfying RT3 as it comes to
it’s e-mail display?

Best Regards,
Daniel

  • daniel@digsys.bg (Daniel Kalchev) [Thu 28 Oct 2004, 16:08 CEST]:

Where is this handled and has someone worked on prettyfying RT3 as it
comes to it’s e-mail display?

Displaying HTML as sent by a user to your ticketing system is a huge
security hole. For example, it could contain some JavaScript that would
send your authentication cookie to the attacker. Or contain enough
invalid HTML to hang or crash your browser (recently a slew of such
remotely exploitable vulnerabilities in about all browsers have been
uncovered).

So, I’m sorry, but there is no easy answer to your question. Filtering
for -style tags has been tried by other people
(e.g. Yahoo! and Hotmail), and it turns out that this nigh impossible:
is one example how it
could be possible to sneak active code into a user’s browser. And then
it turns out you can unicode-escape some characters in the word
`javascript’, so the list of possible holes in such a filter just goes
on and on…

-- Niels.

Today’s subliminal thought is: