Disable attachment and Restrict Extension File for Attachment

1

Dear Besties,

I have 2 issues while using RTIR version 6.0.1 having configured nginx:

  1. I tried to disable the “Choose File”option but failed to do so. (PreferDropzone is only worked)
  2. I also tried to restrict the uploading restrictions for only jpg and pdf uploading but fail to do so.

Please guide me on both of issues.

2

No, there is no built in configuration option to do it. You need a kind of programming or a proxy.

There are three approaches in my mind to do this. The client-side solution does not count for security reasons.

  1. RT Scrip (server-side validation)
    Add a Scrip that checks uploaded attachments during ticket creation or correspondence. Reject the transaction if the file at all or file extension or MIME type is not in the allowed list. This works on exisiting tickets, too.
  2. Local code overlay / Mason callback
    Implement validation in a callback within RT’s Mason templates or Perl modules. This enforces server-side restrictions regardless of the client. This way you can remove the input-fields or check the upload.
  3. External filtering
    Use a proxy, upload gateway, or security appliance to filter disallowed files or file types before they reach RT.
  4. Client-side file selection restriction
    Add HTML/JavaScript to hide/remove the input-field or limit selectable file types (accept=".pdf,.jpeg,.jpg"). This is not sufficient alone because it can be bypassed, but it improves usability. You have to modify SelfService, too

Solution one is not very handy because the server will accept the file first and then discard the transaction.

Decision between solution two or three is the way I’d go if I need to do this.

Keep in mind there is correspondence by mail. Best way is to strip attachements before they reach RT an set a header to trigger a Scrip informing the sender attachments aren’t allowed.

3

Hey,

I have developed support for RT to perform malware scanning of attachments. This is done in RT, so applies to email, web, API and REST interfaces. I had it in the back of my mind that support limiting or blocking file types would be useful, so it has a concept of multiple filters.

I need to do a final review of the code, and then I’ll be submitting it to Best Practical.

Cheers,
Andrew

4

Very good :+1:

Kindly share the solution when applied, thanks.

5

Hi @Andrew_Ruthven did you ever share the code to enable an inline third party malware scanner over email activity and write actions to the database?

We have had an incident where a mail gateway failure populated a malicious PDF attachment into the RT database and generated emails out to helpdesk staff.

EDR worked on client machines but I’d like to belt and brace over the application so we can prevent malicious attachments being uploaded and then sent out. Cheers

6

Hey Chris, sorry to hear you were affected by a malicious PDF!

I’ve just had another look at the code, made some minor clean ups and pushed it to: GitHub - puck/rt at malware-scanner · GitHub I’d be happy to hear feedback.

Kind regards,
Andrew

7

Cheers Andrew, we’ll have a look at the changes to use VirusTotal as a scanning engine and provide feedback

8

I should have also said have a look at docs/malware-scanning.pod. To add support for VirusTotal, I’d suggest you look at adding it to File::VirusScan - Unified interface for virus scanning of files/directories - metacpan.org, as this provides an abstraction for various different virus scanning tools and is what my code uses.

9

Will have a read - is this code to call a scanner likely to be folded into the stable product in a new version?