[request-tracker-maintainers] Bug#951272: rt 4.4 and later spam owner on permission denied

[Antoine Beaupre]

Source: request-tracker4
Version: 4.4.1-3+deb9u3
Severity: normal
Tags: patch upstream

RT 4.4 and later (shipped in buster) change the behavior of the mail
gateway to noisily warn the owner when it fails to create a ticket or
add a corrspondance because of a permission denied error.

This change was introduced in 4.4.0rc1, in the following commit:

https://github.com/bestpractical/rt/commit/03d0af9a7dfe03ce0f2f86f831bcfe19bb29f5a9#diff-a49d7759c3d37e2923b56ea76a2c62ab

That functionality which the commit log refers to used to be an
*optional* plugin, which was removed in:

https://github.com/bestpractical/rt/commit/d6b673a6e606de4ff74e30a3823401940e2cd465

I think that's a mistake. Since the update, we have started seeing a
lot of spam needlessly bounced to the owner email. The reason behind
this is that our RT admins are allowed to block email addresses from
using RT by ticking off the `Let this user access RT` box in the
user's configuration.

Previously, this would make the user see a bounce when they try to
write RT, which is still the case now. But on top of that, the message
is *also* bounced to admins.

That triggered a copious 23 emails just last night, and I suspect much
more is coming to us.

So I sent a PR upstream to revert the change:

https://github.com/bestpractical/rt/pull/291

Could this be integrated in the Debian package?

Thanks!

-- System Information:
Debian Release: 10.3
  APT prefers stable-debug
  APT policy: (500, 'stable-debug'), (500, 'stable'), (1, 'experimental'), (1, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-8-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_CA.UTF-8 (charmap=UTF-8), LANGUAGE=fr_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled