Merge branch 'show-issue-ownership-in-service-desk' into 'master'

Adjust text in issue status header

See merge request gitlab-org/gitlab!81207

doc/user/project/service_desk.md

@@ -330,6 +330,20 @@ Note that:
 - The project's visibility (private, internal, public) does not affect Service Desk.
 - The path to the project, including its group or namespace, is shown in emails.
 
+#### Issues created on someone's behalf
+
+To allow third party applications and ticketing systems to interface with Service Desk,
+when the email contains the `Reply-To` email header, this email address is used as the address of the
+issue author.
+
+Because the `Reply-To` header can be set to arbitrary values, do not blindly trust that an issue
+created on behalf of `someone@example.com` was indeed created by the real owner of such email address.
+
+For example, an email with headers `To: support@example.com` and `Reply-To:someone@example.com`
+creates an issue with the following note:
+
+> Created (…) by `support@example.com` (reply to: `someone@example.com`) (…)
+
 #### Privacy considerations
 
 Service Desk issues are confidential, but the project owner can

lib/gitlab/email/handler/service_desk_handler.rb

@@ -34,7 +34,7 @@ module Gitlab
 
           create_issue_or_note
 
-          if from_address
+          if issue_creator_address
             add_email_participant
             send_thank_you_email unless reply_email?
           end
@@ -98,7 +98,7 @@ module Gitlab
               title: mail.subject,
               description: message_including_template,
               confidential: true,
-              external_author: from_address
+              external_author: external_author
             },
             spam_params: nil
           ).execute
@@ -176,8 +176,22 @@ module Gitlab
           ).execute
         end
 
+        def issue_creator_address
+          reply_to_address || from_address
+        end
+
         def from_address
-          (mail.reply_to || []).first || mail.from.first || mail.sender
+          mail.from.first || mail.sender
+        end
+
+        def reply_to_address
+          (mail.reply_to || []).first
+        end
+
+        def external_author
+          return issue_creator_address unless reply_to_address && from_address
+
+          _("%{from_address} (reply to: %{reply_to_address})") % { from_address: from_address, reply_to_address: reply_to_address }
         end
 
         def can_handle_legacy_format?
@@ -191,7 +205,7 @@ module Gitlab
         def add_email_participant
           return if reply_email? && !Feature.enabled?(:issue_email_participants, @issue.project)
 
-          @issue.issue_email_participants.create(email: from_address)
+          @issue.issue_email_participants.create(email: issue_creator_address)
         end
       end
     end

locale/gitlab.pot

@@ -663,6 +663,9 @@ msgstr ""
 msgid "%{firstMilestoneName} + %{numberOfOtherMilestones} more"
 msgstr ""
 
+msgid "%{from_address} (reply to: %{reply_to_address})"
+msgstr ""
+
 msgid "%{gitlab_experience_text}. Don't worry, this information isn't shared outside of your self-managed GitLab instance."
 msgstr ""
 

spec/fixtures/emails/service_desk_reply_to_and_from.eml

+Delivered-To: incoming+email-test-project_id-issue-@appmail.adventuretime.ooo
+Return-Path: <jake@adventuretime.ooo>
+Received: from iceking.adventuretime.ooo ([unix socket]) by iceking (Cyrus v2.2.13-Debian-2.2.13-19+squeeze3) with LMTPA; Thu, 13 Jun 2013 17:03:50 -0400
+Received: from mail-ie0-x234.google.com (mail-ie0-x234.google.com [IPv6:2607:f8b0:4001:c03::234]) by iceking.adventuretime.ooo (8.14.3/8.14.3/Debian-9.4) with ESMTP id r5DL3nFJ016967 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <incoming+gitlabhq/gitlabhq@appmail.adventuretime.ooo>; Thu, 13 Jun 2013 17:03:50 -0400
+Received: by mail-ie0-f180.google.com with SMTP id f4so21977375iea.25 for <incoming+email-test-project_id-issue-@appmail.adventuretime.ooo>; Thu, 13 Jun 2013 14:03:48 -0700
+Received: by 10.0.0.1 with HTTP; Thu, 13 Jun 2013 14:03:48 -0700
+Date: Thu, 13 Jun 2013 17:03:48 -0400
+Reply-To: Marceline <marceline@adventuretime.ooo>
+From: Finn the Human <finn@adventuretime.ooo>
+Sender: Jake the Dog <jake@adventuretime.ooo>
+To: support@adventuretime.ooo
+Delivered-To: support@adventuretime.ooo
+Message-ID: <CADkmRc+rNGAGGbV2iE5p918UVy4UyJqVcXRO2=otppgzduJSg@mail.gmail.com>
+Subject: The message subject! @all
+Mime-Version: 1.0
+Content-Type: text/plain;
+ charset=ISO-8859-1
+Content-Transfer-Encoding: 7bit
+X-Sieve: CMU Sieve 2.2
+X-Received: by 10.0.0.1 with SMTP id n7mr11234144ipb.85.1371157428600; Thu,
+ 13 Jun 2013 14:03:48 -0700 (PDT)
+X-Scanned-By: MIMEDefang 2.69 on IPv6:2001:470:1d:165::1
+
+Service desk stuff!
+
+```
+a = b
+```

spec/lib/gitlab/email/handler/service_desk_handler_spec.rb

@@ -477,6 +477,20 @@ RSpec.describe Gitlab::Email::Handler::ServiceDeskHandler do
       end
     end
 
+    context 'when there is a reply-to address and a from address' do
+      let(:email_raw) { email_fixture('emails/service_desk_reply_to_and_from.eml') }
+
+      it 'shows both from and reply-to addresses in the issue header' do
+        setup_attachment
+
+        expect { receiver.execute }.to change { Issue.count }.by(1)
+
+        new_issue = Issue.last
+
+        expect(new_issue.external_author).to eq('finn@adventuretime.ooo (reply to: marceline@adventuretime.ooo)')
+      end
+    end
+
     context 'when service desk is not enabled for project' do
       before do
         allow(Gitlab::ServiceDesk).to receive(:enabled?).and_return(false)