Ignore the local directory which contains additional, temporarily non-public tests
Pull back docs/security.pod from 4.0-trunk
Add a note about the timeline on public announcements, tests, etc
Avoid shell interpolation when calling sendmailpipe

Use IPC::Open2 rather than three-arg open with "|-", to prevent shell
interpolation.  This allows not only fine control of the parameters to
the sendmail command, but also allows the STDOUT content to be dropped,
as was previously handled using a shell output redirect.  For backwards
compatability, use Text::ParseWords to split the configuration
parameters which are strings, rather than argument lists.

This prevents a vulnerability where specially-crafted emails could allow
code execution if VERP was enabled.

This resolves CVE-2011-2082.
Prevent storing the old or new hashed password in the transaction table
Clean out sensitive user transactions
Add a consistent CurrentUserCanSee right
Enable ACL checks for non-Ticket transactions

Use CurrentUserCanSee on relevant object to prevent access to
Transactions that the user shouldn't be able to see.

This partially resolves CVE-2011-2084.
Remove unused $args and @arglist variables
Explicitly ACL ObjectCustomFieldValue content, based on the custon field object
There is no reason for ->NewValue and ->OldValue to skip ACLs via __Value
Prevent actual error messages from propagating to the user

With DevelMode off, Mason formats runtime errors using the 'brief'
format, which includes the full path on disk to where the error ocurred.
This is a potential information leak.  Instead, provide a generic error
message to the user, but log the actual error in the logs.
Escape all arguments passed to /l

Escaping arguments prevents one of the easiest ways to accidentally
write XSS vectors.  For /l calls which pass HTML in their arguments,
/l_unsafe is provided which preserves the previous behaviour.  Note that
the text to be localized itself is not escaped, only the placeholder
values.  Hopefully seeing "unsafe" in the name will also make folks
pause and consider what they're doing.

Partially resolves CVE-2011-2083.
We did not find and upgrade passwords for disabled users.

This script can be safely re-run on RT installations which were
previously upgraded.
Remove extra SendSessionCookie() calls

Calling SendSessionCookie() is only necessary after the cookie value has
changed, which only happens in two places -- initially, after the
current cookie is read, or after successful authentication, when we
change the session identifier to avoid session fixation.  Additional
calls to SendSessionCookie only confuse when it is necessary.
Add basic HTTP_REFERER checking to prevent cross-site request forgery

RT has had a long-standing policy of accepting query parameters in both
POST and GET, and taking action based on them.  Unfortunately, this
makes RT susceptible to cross-site request forgery (CSRF), wherein the
browser is tricked into making a request on behalf of the user, which
includes the user's cached credentials, and the remote server runs an
malicious action with the user's identity.

Prevent this by enforcing that all requests to RT come with a "Referer"
(sic) header of RT itself.  Studies have shown that while the incidence
of suppressed or incorrect Referer headers is non-trivial over unsecured
HTTP (3% - 11%), it is very uncommon (0.05% - %0.22%) when the server is
secured using HTTPS[1].  As running RT without SSL protection already
presents a host of other vulnerabilities, including man-in-the-middle
attacks and password sniffing, we have judged that disabling CSRF
protections in HTTP-only deployments should be an acceptable solution.

Enforcing that all requests have such a header is entirely too
restrictive, as it prevents a large number of idempotent requests which
are not abusable, but provides the foundation of the CSRF protection.

This resolves CVE-2011-2085.

[1] http://seclab.stanford.edu/websec/csrf/csrf.pdf
Whitelist some component (not request!) paths

The RSS feed, despite being requested with no Referer header, and having
query parameters, modifies no state on the server, and as such should be
exempt from CSRF checks.
Redirect to an interstitial page on CSRF attacks, rather than denying

As some browsers never supply Referer headers, and to maintain better
integration with other sites which may link into RT, simply denying the
a potential CSRF request with no recourse is unfortunate, and
frustrating to the user.

Instead, store the request parameters in a unique key on the session,
and provide a page with a link which will extract them again and re-run
the request.  This allows intercepted requests to continue with only one
extra click.
Ensure that publicly cachable content does not contain Set-Cookie headers
Only run known formatters in RT::Date

To make a formatter known to RT, you should:

    push @RT::Date::FORMATTERS, 'YourFormatter';

This resolves part of CVE-2011-4458.