Ensure that filenames in inline image attributes are HTML-escaped
Deny direct access to callbacks

Callbacks are meant to be called from the context of an core Mason
component, and do not expect to receive arbitrary input from query
parameters.  As such, deny access to them from the top-level request.
Protect calls to $m->comp with user input in ColumnMap

$Class may leak in from the user, which would allow calling arbitrary
components.  Protect it by using ComponentPathIsSafe, extended to ensure
that the path cannot be truncated early by way of embedded nulls.
Ensure that subjects cannot contain embedded newlines

The default templates embed the ticket's subject in the outgoing Subject
header -- but have no way to ensure that the subject does not contain
newlines, which could be used to insert additional headers.
Programmatically restricting templates from inserting newlines in the
header section is both difficult and overly limiting, as there are valid
reasons to do so.

Strip all newlines from Subject headers.  While this does resolves the
issue for all core RT templates, solving it more generally is
unfortunately not feasable.
Remove filename= suggesions from Content-Disposition lines

No supported standard exists for escaping of the "filename" attribute of
Content-Disposition.  This opens the possibility of various injection
attacks through carefully-crafted filenames if AlwaysDownloadAttachments
is enabled.

As the download endpoint is a dhandler, and most locations already
supply the filename after the final /, browsers will assume the correct
filename even if none is supplied to Content-Disposition.  Hence, remove
the filename= parameter entirely.
Ensure consistent escaping of filenames in attachment URIs

<% $value |u %> still applies HTML escaping before URI escaping, which
is incorrect, as it leads to files named «a"test".txt» being linked with
URIs like «a%26%2334%3Btest%26%2334%3B.txt» -- the URI-escaped version
of «a&#34;test&#34;.txt».

Ensure that these URIs are only URI-escaped (yilding «a%22test%22.txt»
in this example), such that browsers correctly parse the intended
filename from the URI.
Ensure that URLs placed in HTML attributes are escaped correctly, to prevent XSS injection
Ensure that the default replacement does not pass through unescaped content

This is only relevant in the case of a MakeClicky misconfiguration.
Use File::Temp for non-predictable temporary filenames

Previously, RT wrote to /tmp/rt.form.$$, which is a semi-predictable
filename.  A malicious user could symlink a file of their choosing into
that location, which a privileged user running bin/rt would then
overwrite.  While this race condition would be difficult to exploit, as
it leaves the attacker with no control over the contents of the file,
and relies on beating the race condition, it is still potentially
dangerous.

Use File::Temp to atomically generate a non-predictable filename and
open it for writing.
Merge remote-tracking branch 'private/security/3.8/attachment-filename-escaping' into security/3.8.17-releng
Merge remote-tracking branch 'private/security/3.8/deny-direct-callback-access' into security/3.8.17-releng
Merge remote-tracking branch 'private/security/3.8/escape-attachment-filename' into security/3.8.17-releng
Merge remote-tracking branch 'private/security/3.8/escape-makeclicky' into security/3.8.17-releng
Merge remote-tracking branch 'private/security/3.8/protect-columnmap-comp' into security/3.8.17-releng
Merge remote-tracking branch 'private/security/3.8/rt-predictable-tmpfile' into security/3.8.17-releng
Merge remote-tracking branch 'private/security/3.8/subject-newlines' into security/3.8.17-releng
Bump version for 3.8.17
Merge branch 'security/3.8.17-releng' into 3.8-trunk

Version in configure.ac reverted back to 3.8.HEAD.

Resolves:

    CVE-2013-3368
    CVE-2013-3369
    CVE-2013-3370
    CVE-2013-3371
    CVE-2013-3372
    CVE-2013-3373
    CVE-2013-3374