Remove unused GenericQueryArgs parameter
Similarly, there is no reason to configure AllowSorting
Disallow setting arbitrary titles
Disallow setting of roles via query params

This closes a hole wherein unprivileged users could inject TicketSQL.
While this is not in itself dangerous, it might allow unprivileged users
to see unexpected tickets if rights have been mis-applied by the
administrator (such as giving ShowTicket to Everyone).
Escape subject and links in /m/ticket/create
Escape the name of the predefined search that was not found
Escape save search names when we report errors about loading them
Explicitly pass the type of escaping we want to apply_escapes
Use loc for interpolation
Iterate attachments as the creator of the current transaction when sending mail

Check CurrentUserCanSee before trying to add an attachment since it
could otherwise end up empty now that we have the correct current user.

Additionally, simply check RT::Transaction's CurrentUserCanSee when
iterating inside an RT::Attachments object rather than maintaining a
different but similar conditional tree.  CurrentUserCanSee correctly
access checks transaction types like EmailRecord, for example.

This resolves part of CVE-2011-2084.
Ensure the empty CFVs collection never returns results after a failed rights check

This is identical to negative limiting we do elsewhere to ensure no
records are returned.

This resolves part of CVE-2011-2084.
Push id = 0 limits into an ACL subclause

This ensures the id = 0 condition isn't OR'd with a subsequent limit
after we return the collection.
Ensure that publicly cachable content does not contain Set-Cookie headers
Only run known formatters in RT::Date

To make a formatter known to RT, you should:

    push @RT::Date::FORMATTERS, 'YourFormatter';

This resolves part of CVE-2011-4458.
Don't execute non-Perl templates in RT::Action::CreateTickets

Simple templates passed to the CreateTickets action used to be evaluated
directly with Text::Template, including any Perl contained within them.
This allowed users without ExecuteCode—or systems configured to
DisallowExecuteCode—to still create templates and scrips that executed
Perl code.

This resolves part of CVE-2011-4458.
Prevent user-controlled partial component paths from walking up directories

Mason didn't let through paths outside of it's component roots, but it
did mean private components were accessible semi-directly.
Make CheckIntegrity idempotent on a running install

Avoid reconnecting to the database if we have a handle and stop trying
to initialize the logger.  These changes make it safe to call as many
times as you'd like on a running instance without affecting the app.
Specifically, CheckIntegrity is now safely callable from places other
than server initialization.

Note that any calls to CheckIntegrity must now come _after_
InitLogging() is called.  In RT 4, CheckIntegrity is only called in
rt-server.
Refuse to turn on InstallMode when we have database integrity

This prevents install mode from activating on a working install and
resolves part of CVE-2011-4458.
Prevent actual error messages from propagating to the user

With DevelMode off, Mason formats runtime errors using the 'brief'
format, which includes the full path on disk to where the error ocurred.
This is a potential information leak.  Instead, provide a generic error
message to the user, but log the actual error in the logs.
Escape backslashes in text used for GraphViz input

Previously you could avoid the double quote escaping by proceeding your
double quote with a backslash.  The backslash naively added by gv_escape
would itself be escaped by your original backslash, leaving the quote
unescaped.  This most often simply broke GraphViz output rendering it
unusable.

While injecting arbitrary input into GraphViz is of unlikely utility,
GraphViz did have a buffer overflow vulnerability in versions 2.20.2 and
earlier as described in CVE-2008-4555.