From 649e42551893d748cd196a0b46624766f9c266e7 Mon Sep 17 00:00:00 2001
From: Andrew Ruthven <andrew@etc.gen.nz>
Date: Sun, 8 Oct 2023 22:51:44 +1300
Subject: Fix a number of security issues in RT.

* RT is vulnerable to unvalidated email headers in incoming email and the
  mail-gateway REST interface. This vulnerability is assigned CVE-2023-41259.
* RT is vulnerable to information leakage via response messages returned from
  requests sent via the mail-gateway REST interface. This vulnerability is
  assigned CVE-2023-41260.
* RT 5.0 is vulnerable to information leakage via transaction searches made
  by authenticated users in the transaction query builder. This vulnerability
  is assigned CVE-2023-45024.
* RT 5.0 can reveal information about data on various RT objects in errors
  and other response messages to REST 2 requests.

Patch-Name: upstream_5.0.3_cve:_patchset_2023-09-26.diff
Author: Best Practical <support@bestpractical.com>
Forwarded: not-needed
Applied: 5.0.5
---
 docs/web_deployment.pod                       | 25 +++++
 lib/RT/Articles.pm                            |  5 +
 lib/RT/Assets.pm                              |  5 +
 lib/RT/Attachment.pm                          | 11 +++
 lib/RT/Catalog.pm                             | 22 +++++
 lib/RT/Catalogs.pm                            |  5 +
 lib/RT/Class.pm                               | 33 +++++++
 lib/RT/Classes.pm                             |  5 +
 lib/RT/CustomField.pm                         | 22 +++++
 lib/RT/CustomFields.pm                        |  5 +
 lib/RT/CustomRole.pm                          | 22 +++++
 lib/RT/CustomRoles.pm                         |  6 ++
 lib/RT/Group.pm                               | 34 ++++++-
 lib/RT/Groups.pm                              |  5 +
 lib/RT/Interface/Email.pm                     |  4 +
 lib/RT/Interface/Email/Crypt.pm               |  5 +-
 lib/RT/Interface/Web.pm                       | 22 +++++
 lib/RT/ObjectCustomFieldValue.pm              |  1 +
 lib/RT/Queue.pm                               | 23 +++++
 lib/RT/Queues.pm                              |  5 +
 lib/RT/REST2/Resource/Article.pm              | 10 +-
 lib/RT/REST2/Resource/Asset.pm                |  6 +-
 lib/RT/REST2/Resource/Collection.pm           | 28 +++---
 lib/RT/REST2/Resource/CustomField.pm          | 15 ---
 lib/RT/REST2/Resource/Group.pm                | 39 +++-----
 lib/RT/REST2/Resource/GroupMembers.pm         |  2 -
 .../REST2/Resource/ObjectCustomFieldValue.pm  |  6 --
 lib/RT/REST2/Resource/RT.pm                   |  4 +-
 lib/RT/REST2/Resource/Record.pm               | 17 +++-
 lib/RT/REST2/Resource/Ticket.pm               | 11 +--
 lib/RT/REST2/Resource/User.pm                 |  3 +-
 lib/RT/SearchBuilder.pm                       |  5 +
 lib/RT/SearchBuilder/Role/Roles.pm            |  4 +-
 lib/RT/Ticket.pm                              |  4 +
 lib/RT/Tickets.pm                             | 11 ++-
 lib/RT/Transactions.pm                        | 98 ++++++++++++++++++-
 lib/RT/Users.pm                               |  5 +
 share/html/Elements/CollectionList            |  6 +-
 share/html/REST/1.0/NoAuth/mail-gateway       | 13 ++-
 share/html/Search/Results.html                | 10 +-
 share/html/Search/Results.tsv                 | 10 +-
 41 files changed, 451 insertions(+), 121 deletions(-)

diff --git a/docs/web_deployment.pod b/docs/web_deployment.pod
index 6ee03d48..c2200110 100644
--- a/docs/web_deployment.pod
+++ b/docs/web_deployment.pod
@@ -127,6 +127,31 @@ RT to access the Authorization header.
 
 More information is available in L<RT::Authen::Token>.
 
+=head3 Restricting the REST 1.0 mail-gateway
+
+RT processes email via a REST 1.0 endpoint. If you accept email on the same
+server as your running RT, you can restrict this endpoint to localhost only
+with a configuration like the following:
+
+    # Accept requests only from localhost
+    <Location /REST/1.0/NoAuth/mail-gateway>
+        Require local
+    </Location>
+
+If you run C<bin/rt-mailgate> on a separate server, you can update
+the above to allow additional IP addresses.
+
+    <Location /REST/1.0/NoAuth/mail-gateway>
+        Require ip 127.0.0.1 ::1 192.0.2.0  # Add you actual IPs
+    </Location>
+
+See the L<Apache documentation|https://httpd.apache.org/docs/2.4/mod/mod_authz_host.html>
+for additional configuration options.
+
+After adding this configuration, test receiving email and confirm
+your C<bin/rt-mailgate> utility and C</etc/aliases> configurations
+can successfully submit email to RT.
+
 =head2 nginx
 
 C<nginx> requires that you start RT's fastcgi process externally, for
diff --git a/lib/RT/Articles.pm b/lib/RT/Articles.pm
index 285cfe6d..a2e70bab 100644
--- a/lib/RT/Articles.pm
+++ b/lib/RT/Articles.pm
@@ -968,6 +968,11 @@ sub SimpleSearch {
     return $self;
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'ShowArticle', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/Assets.pm b/lib/RT/Assets.pm
index 046a834e..d7b390b2 100644
--- a/lib/RT/Assets.pm
+++ b/lib/RT/Assets.pm
@@ -1857,6 +1857,11 @@ sub _ProcessRestrictions {
 
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'ShowAsset', Object => RT->System ) ? 1 : 0;
+}
+
 1;
 
 RT::Base->_ImportOverlays();
diff --git a/lib/RT/Attachment.pm b/lib/RT/Attachment.pm
index b0b2fc66..2cfbea14 100644
--- a/lib/RT/Attachment.pm
+++ b/lib/RT/Attachment.pm
@@ -1084,6 +1084,17 @@ sub _CacheConfig {
 }
 
 
+=head2 CurrentUserCanSee
+
+Returns true if the current user can see the attachment, via corresponding
+transaction's rights check.
+
+=cut
+
+sub CurrentUserCanSee {
+    my $self = shift;
+    return $self->TransactionObj->CurrentUserCanSee;
+}
 
 
 =head2 id
diff --git a/lib/RT/Catalog.pm b/lib/RT/Catalog.pm
index 41504233..7ddb1245 100644
--- a/lib/RT/Catalog.pm
+++ b/lib/RT/Catalog.pm
@@ -297,6 +297,28 @@ sub CurrentUserCanSee {
         || $self->CurrentUserHasRight('AdminCatalog');
 }
 
+=head2 CurrentUserCanCreate
+
+Returns true if the current user can create a new catalog, using I<AdminCatalog>.
+
+=cut
+
+sub CurrentUserCanCreate {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminCatalog');
+}
+
+=head2 CurrentUserCanModify
+
+Returns true if the current user can modify the catalog, using I<AdminCatalog>.
+
+=cut
+
+sub CurrentUserCanModify {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminCatalog');
+}
+
 =head2 Owner
 
 Returns an L<RT::User> object for this catalog's I<Owner> role group.  On error,
diff --git a/lib/RT/Catalogs.pm b/lib/RT/Catalogs.pm
index 31b2a0e1..06590225 100644
--- a/lib/RT/Catalogs.pm
+++ b/lib/RT/Catalogs.pm
@@ -114,6 +114,11 @@ sub _Init {
 
 sub Table { "Catalogs" }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'ShowCatalog', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/Class.pm b/lib/RT/Class.pm
index 236d8548..cd5fcf07 100644
--- a/lib/RT/Class.pm
+++ b/lib/RT/Class.pm
@@ -396,6 +396,39 @@ sub SetSubjectOverride {
     }
 }
 
+=head2 CurrentUserCanSee
+
+Returns true if the current user can see the class, using I<SeeClass>.
+
+=cut
+
+sub CurrentUserCanSee {
+    my $self = shift;
+    return $self->CurrentUserHasRight('SeeClass');
+}
+
+=head2 CurrentUserCanCreate
+
+Returns true if the current user can create a new class, using I<AdminClass>.
+
+=cut
+
+sub CurrentUserCanCreate {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminClass');
+}
+
+=head2 CurrentUserCanModify
+
+Returns true if the current user can modify the class, using I<AdminClass>.
+
+=cut
+
+sub CurrentUserCanModify {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminClass');
+}
+
 =head2 id
 
 Returns the current value of id. 
diff --git a/lib/RT/Classes.pm b/lib/RT/Classes.pm
index c2dd6328..b665b83c 100644
--- a/lib/RT/Classes.pm
+++ b/lib/RT/Classes.pm
@@ -81,6 +81,11 @@ sub AddRecord {
 
 sub _SingularClass { "RT::Class" }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'SeeClass', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/CustomField.pm b/lib/RT/CustomField.pm
index c0112ae7..9a042ac9 100644
--- a/lib/RT/CustomField.pm
+++ b/lib/RT/CustomField.pm
@@ -2166,6 +2166,28 @@ sub RegisterLookupType {
     $FRIENDLY_LOOKUP_TYPES{$path} = $friendly_name;
 }
 
+=head2 CurrentUserCanCreate
+
+If the user has I<AdminCustomField> they can create a new custom field.
+
+=cut
+
+sub CurrentUserCanCreate {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminCustomField');
+}
+
+=head2 CurrentUserCanModify
+
+If the user has I<AdminCustomField> they can modify the custom field.
+
+=cut
+
+sub CurrentUserCanModify {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminCustomField');
+}
+
 =head2 IncludeContentForValue [VALUE] (and SetIncludeContentForValue)
 
 Gets or sets the  C<IncludeContentForValue> for this custom field. RT
diff --git a/lib/RT/CustomFields.pm b/lib/RT/CustomFields.pm
index 76157990..bc93a6d5 100644
--- a/lib/RT/CustomFields.pm
+++ b/lib/RT/CustomFields.pm
@@ -475,6 +475,11 @@ sub LimitToCatalog  {
     }
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'SeeCustomField', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/CustomRole.pm b/lib/RT/CustomRole.pm
index fa4ec0f7..80b8e916 100644
--- a/lib/RT/CustomRole.pm
+++ b/lib/RT/CustomRole.pm
@@ -502,6 +502,28 @@ sub GroupType {
     return 'RT::CustomRole-' . $self->id;
 }
 
+=head2 CurrentUserCanCreate
+
+Returns true if the current user can create a new custom role, using I<AdminCustomRoles>.
+
+=cut
+
+sub CurrentUserCanCreate {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminClass');
+}
+
+=head2 CurrentUserCanModify
+
+Returns true if the current user can modify the custom role, using I<AdminCustomRoles>.
+
+=cut
+
+sub CurrentUserCanModify {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminClass');
+}
+
 =head2 id
 
 Returns the current value of id.
diff --git a/lib/RT/CustomRoles.pm b/lib/RT/CustomRoles.pm
index f49a9f9e..dc2b0d58 100644
--- a/lib/RT/CustomRoles.pm
+++ b/lib/RT/CustomRoles.pm
@@ -195,6 +195,12 @@ sub LimitToAdded {
     return RT::ObjectCustomRoles->new( $self->CurrentUser )->LimitTargetToAdded( $self => @_ );
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    # Not typo, user needs SeeQueue to see CustomRoles
+    return $self->CurrentUser->HasRight( Right => 'SeeQueue', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/Group.pm b/lib/RT/Group.pm
index 7f9854a2..0e8da390 100644
--- a/lib/RT/Group.pm
+++ b/lib/RT/Group.pm
@@ -1311,17 +1311,43 @@ sub _Set {
 
 =head2 CurrentUserCanSee
 
-Always returns 1; unfortunately, for historical reasons, users have
-always been able to examine groups they have indirect access to, even if
-they do not have SeeGroup explicitly.
+Unfortunately, for historical reasons, users have always been able to
+examine groups they have indirect access to, even if they do not have
+SeeGroup explicitly.
+
+We do require "SeeGroup" to see transactions of current group.
 
 =cut
 
 sub CurrentUserCanSee {
     my $self = shift;
-    return 1;
+    my ($what, $txn) = @_;
+
+    return 1 if ( $what // '' ) ne 'Transaction';
+    return $self->CurrentUserHasRight('SeeGroup');
+}
+
+=head2 CurrentUserCanCreate
+
+Returns true if the current user can create a new group, using I<AdminGroup>.
+
+=cut
+
+sub CurrentUserCanCreate {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminGroup');
 }
 
+=head2 CurrentUserCanModify
+
+Returns true if the current user can modify the group, using I<AdminGroup>.
+
+=cut
+
+sub CurrentUserCanModify {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminGroup');
+}
 
 =head2 PrincipalObj
 
diff --git a/lib/RT/Groups.pm b/lib/RT/Groups.pm
index 2dd03bf5..1222fbfb 100644
--- a/lib/RT/Groups.pm
+++ b/lib/RT/Groups.pm
@@ -537,6 +537,11 @@ sub SimpleSearch {
     return $self;
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'SeeGroup', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/Interface/Email.pm b/lib/RT/Interface/Email.pm
index 1218b628..0a3acd08 100644
--- a/lib/RT/Interface/Email.pm
+++ b/lib/RT/Interface/Email.pm
@@ -161,6 +161,10 @@ sub Gateway {
         );
     }
 
+    # Clean up sensitive headers. Crypt related headers are cleaned up in RT::Interface::Email::Crypt::VerifyDecrypt
+    my @headers = qw( RT-Attach RT-Send-Cc RT-Send-Bcc RT-Message-ID RT-DetectedAutoGenerated RT-Squelch-Replies-To );
+    $Message->head->delete($_) for @headers;
+
     #Set up a queue object
     my $SystemQueueObj = RT::Queue->new( RT->SystemUser );
     $SystemQueueObj->Load( $args{'queue'} );
diff --git a/lib/RT/Interface/Email/Crypt.pm b/lib/RT/Interface/Email/Crypt.pm
index f4eab019..a8b0ea3f 100644
--- a/lib/RT/Interface/Email/Crypt.pm
+++ b/lib/RT/Interface/Email/Crypt.pm
@@ -73,13 +73,14 @@ sub VerifyDecrypt {
     );
 
     # we clean all possible headers
-    my @headers =
+    my @headers = (
         qw(
             X-RT-Incoming-Encryption
             X-RT-Incoming-Signature X-RT-Privacy
             X-RT-Sign X-RT-Encrypt
         ),
-        map "X-RT-$_-Status", RT::Crypt->Protocols;
+        map "X-RT-$_-Status", RT::Crypt->Protocols
+    );
     foreach my $p ( $args{'Message'}->parts_DFS ) {
         $p->head->delete($_) for @headers;
     }
diff --git a/lib/RT/Interface/Web.pm b/lib/RT/Interface/Web.pm
index 41c00816..9133deec 100644
--- a/lib/RT/Interface/Web.pm
+++ b/lib/RT/Interface/Web.pm
@@ -5298,6 +5298,28 @@ sub GetDashboards {
     return \%dashboards;
 }
 
+sub PreprocessTransactionSearchQuery {
+    my %args = (
+        Query      => undef,
+        ObjectType => 'RT::Ticket',
+        @_
+    );
+
+    my @limits;
+    if ( $args{ObjectType} eq 'RT::Ticket' ) {
+        @limits = (
+            q{TicketType = 'ticket'},
+            qq{ObjectType = '$args{ObjectType}'},
+            $args{Query} =~ /^\s*\(.*\)$/ ? $args{Query} : "($args{Query})"
+        );
+    }
+    else {
+        # Other ObjectTypes are not supported for now
+        @limits = 'id = 0';
+    }
+    return join ' AND ', @limits;
+}
+
 package RT::Interface::Web;
 RT::Base->_ImportOverlays();
 
diff --git a/lib/RT/ObjectCustomFieldValue.pm b/lib/RT/ObjectCustomFieldValue.pm
index e28c3376..1e025f80 100644
--- a/lib/RT/ObjectCustomFieldValue.pm
+++ b/lib/RT/ObjectCustomFieldValue.pm
@@ -815,6 +815,7 @@ object, otherwise false.
 
 sub CurrentUserCanSee {
     my $self = shift;
+    return undef unless $self->Id;
     return $self->CustomFieldObj->CurrentUserHasRight('SeeCustomField');
 }
 
diff --git a/lib/RT/Queue.pm b/lib/RT/Queue.pm
index 6aa8ed98..bb6cfb81 100644
--- a/lib/RT/Queue.pm
+++ b/lib/RT/Queue.pm
@@ -813,6 +813,29 @@ sub CurrentUserCanSee {
     return $self->CurrentUserHasRight('SeeQueue');
 }
 
+
+=head2 CurrentUserCanCreate
+
+Returns true if the current user can create a new queue, using I<AdminQueue>.
+
+=cut
+
+sub CurrentUserCanCreate {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminQueue');
+}
+
+=head2 CurrentUserCanModify
+
+Returns true if the current user can modify the queue, using I<AdminQueue>.
+
+=cut
+
+sub CurrentUserCanModify {
+    my $self = shift;
+    return $self->CurrentUserHasRight('AdminQueue');
+}
+
 =head2 id
 
 Returns the current value of id. 
diff --git a/lib/RT/Queues.pm b/lib/RT/Queues.pm
index 4612f545..356fdfae 100644
--- a/lib/RT/Queues.pm
+++ b/lib/RT/Queues.pm
@@ -128,6 +128,11 @@ sub ItemsOrderBy {
     return $items;
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'SeeQueue', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/REST2/Resource/Article.pm b/lib/RT/REST2/Resource/Article.pm
index fea9f9d9..df3b81f5 100644
--- a/lib/RT/REST2/Resource/Article.pm
+++ b/lib/RT/REST2/Resource/Article.pm
@@ -80,17 +80,11 @@ sub create_record {
 
     return (\400, "Invalid Class") if !$data->{Class};
 
-    my $class = RT::Class->new(RT->SystemUser);
+    my $class = RT::Class->new($self->current_user);
     $class->Load($data->{Class});
 
-    return (\400, "Invalid Class") if !$class->Id;
-
     return ( \403, $self->record->loc("Permission Denied") )
-        unless $self->record->CurrentUser->HasRight(
-        Right  => 'CreateArticle',
-        Object => $class,
-        )
-        and $class->Disabled != 1;
+        unless $class->Id and !$class->__Value('Disabled') and $class->CurrentUserHasRight('CreateArticle');
 
     my ($ok, $txn, $msg) = $self->_create_record($data);
     return ($ok, $msg);
diff --git a/lib/RT/REST2/Resource/Asset.pm b/lib/RT/REST2/Resource/Asset.pm
index 23e6ae07..588dc093 100644
--- a/lib/RT/REST2/Resource/Asset.pm
+++ b/lib/RT/REST2/Resource/Asset.pm
@@ -83,10 +83,8 @@ sub create_record {
     my $catalog = RT::Catalog->new($self->record->CurrentUser);
     $catalog->Load($data->{Catalog});
 
-    return (\400, "Invalid Catalog") if !$catalog->Id;
-
-    return (\403, $self->record->loc("Permission Denied", $catalog->Name))
-        unless $catalog->CurrentUserHasRight('CreateAsset');
+    return (\403, $self->record->loc("Permission Denied"))
+        unless $catalog->Id and !$catalog->__Value('Disabled') and $catalog->CurrentUserHasRight('CreateAsset');
 
     return $self->_create_record($data);
 }
diff --git a/lib/RT/REST2/Resource/Collection.pm b/lib/RT/REST2/Resource/Collection.pm
index e3ea2ced..7fd639ed 100644
--- a/lib/RT/REST2/Resource/Collection.pm
+++ b/lib/RT/REST2/Resource/Collection.pm
@@ -189,7 +189,7 @@ sub serialize {
 
     my %results = (
         count       => scalar(@results)         + 0,
-        total       => $collection->CountAll    + 0,
+        total       => $collection->CurrentUserCanSeeAll ? ( $collection->CountAll + 0 ) : undef,
         per_page    => $collection->RowsPerPage + 0,
         page        => ($collection->FirstRow / $collection->RowsPerPage) + 1,
         items       => \@results,
@@ -205,18 +205,20 @@ sub serialize {
         }
     }
 
-    $results{pages} = ceil($results{total} / $results{per_page});
-    if ($results{page} < $results{pages}) {
-        my $page = $results{page} + 1;
-        $uri->query_form( @query_form, page => $results{page} + 1 );
-        $results{next_page} = $uri->as_string;
-    };
-    if ($results{page} > 1) {
-        # If we're beyond the last page, set prev_page as the last page
-        # available, otherwise, the previous page.
-        $uri->query_form( @query_form, page => ($results{page} > $results{pages} ? $results{pages} : $results{page} - 1) );
-        $results{prev_page} = $uri->as_string;
-    };
+    $results{pages} = defined $results{total} ? ceil($results{total} / $results{per_page}) : undef;
+    if ( $results{pages} ) {
+        if ($results{page} < $results{pages}) {
+            my $page = $results{page} + 1;
+            $uri->query_form( @query_form, page => $results{page} + 1 );
+            $results{next_page} = $uri->as_string;
+        }
+        if ($results{page} > 1) {
+            # If we're beyond the last page, set prev_page as the last page
+            # available, otherwise, the previous page.
+            $uri->query_form( @query_form, page => ($results{page} > $results{pages} ? $results{pages} : $results{page} - 1) );
+            $results{prev_page} = $uri->as_string;
+        }
+    }
 
     return \%results;
 }
diff --git a/lib/RT/REST2/Resource/CustomField.pm b/lib/RT/REST2/Resource/CustomField.pm
index 5f81f669..69b1825f 100644
--- a/lib/RT/REST2/Resource/CustomField.pm
+++ b/lib/RT/REST2/Resource/CustomField.pm
@@ -87,21 +87,6 @@ sub serialize {
     return $data;
 }
 
-sub forbidden {
-    my $self = shift;
-    my $method = $self->request->method;
-    if ($self->record->id) {
-        if ($method eq 'GET') {
-            return !$self->record->CurrentUserHasRight('SeeCustomField');
-        } else {
-            return !($self->record->CurrentUserHasRight('SeeCustomField') && $self->record->CurrentUserHasRight('AdminCustomField'));
-        }
-    } else {
-        return !$self->current_user->HasRight(Right => "AdminCustomField", Object => RT->System);
-    }
-    return 0;
-}
-
 sub hypermedia_links {
     my $self = shift;
     my $links = $self->_default_hypermedia_links(@_);
diff --git a/lib/RT/REST2/Resource/Group.pm b/lib/RT/REST2/Resource/Group.pm
index ea90c816..2f61ec6a 100644
--- a/lib/RT/REST2/Resource/Group.pm
+++ b/lib/RT/REST2/Resource/Group.pm
@@ -58,9 +58,7 @@ extends 'RT::REST2::Resource::Record';
 with 'RT::REST2::Resource::Record::Readable'
         => { -alias => { serialize => '_default_serialize' } },
     'RT::REST2::Resource::Record::DeletableByDisabling',
-        => { -alias => { delete_resource => '_delete_resource' } },
     'RT::REST2::Resource::Record::Writable',
-        => { -alias => { create_record => '_create_record' } },
     'RT::REST2::Resource::Record::Hypermedia'
         => { -alias => { hypermedia_links => '_default_hypermedia_links' } };
 
@@ -102,33 +100,20 @@ sub hypermedia_links {
     return $links;
 }
 
-sub create_record {
+override forbidden => sub {
     my $self = shift;
-    my $data = shift;
 
-    return (\403, $self->record->loc("Permission Denied"))
-        unless  $self->current_user->HasRight(
-            Right   => "AdminGroup",
-            Object  => RT->System,
-        );
-
-    return $self->_create_record($data);
-}
-
-sub delete_resource {
-    my $self = shift;
-
-    return (\403, $self->record->loc("Permission Denied"))
-        unless $self->record->CurrentUserHasRight('AdminGroup');
-
-    return $self->_delete_resource;
-}
-
-sub forbidden {
-    my $self = shift;
-    return 0 unless $self->record->id;
-    return !$self->record->CurrentUserHasRight('SeeGroup');
-}
+    # For historical reasons, RT::Group::CurrentUserCanSee always returns true.
+    # For REST2, we want to check SeeGroup.
+    no warnings 'redefine';
+    my $original_can_see = \&RT::Group::CurrentUserCanSee;
+    local *RT::Group::CurrentUserCanSee = sub {
+        my $self = shift;
+        return 0 unless $original_can_see->($self, @_);
+        return $self->CurrentUserHasRight('SeeGroup');
+    };
+    return super();
+};
 
 __PACKAGE__->meta->make_immutable;
 
diff --git a/lib/RT/REST2/Resource/GroupMembers.pm b/lib/RT/REST2/Resource/GroupMembers.pm
index 887562dc..cc9198fa 100644
--- a/lib/RT/REST2/Resource/GroupMembers.pm
+++ b/lib/RT/REST2/Resource/GroupMembers.pm
@@ -114,9 +114,7 @@ sub dispatch_rules {
 
 sub forbidden {
     my $self = shift;
-    return 0 unless $self->group->id;
     return !$self->group->CurrentUserHasRight('AdminGroupMembership');
-    return 1;
 }
 
 sub serialize {
diff --git a/lib/RT/REST2/Resource/ObjectCustomFieldValue.pm b/lib/RT/REST2/Resource/ObjectCustomFieldValue.pm
index a3a1607b..10416970 100644
--- a/lib/RT/REST2/Resource/ObjectCustomFieldValue.pm
+++ b/lib/RT/REST2/Resource/ObjectCustomFieldValue.pm
@@ -71,12 +71,6 @@ sub content_types_provided {
     { [ {$self->record->ContentType || 'text/plain; charset=utf-8' => 'to_binary'} ] };
 }
 
-sub forbidden {
-    my $self = shift;
-    return 0 unless $self->record->id;
-    return !$self->record->CurrentUserHasRight('SeeCustomField');
-}
-
 sub to_binary {
     my $self = shift;
     unless ($self->record->CustomFieldObj->Type =~ /^(?:Image|Binary)$/) {
diff --git a/lib/RT/REST2/Resource/RT.pm b/lib/RT/REST2/Resource/RT.pm
index 8b0756a3..545a48dd 100644
--- a/lib/RT/REST2/Resource/RT.pm
+++ b/lib/RT/REST2/Resource/RT.pm
@@ -71,7 +71,9 @@ sub to_json {
     my $self = shift;
     return JSON::to_json({
         Version => $RT::VERSION,
-        Plugins => [ RT->Config->Get('Plugins') ],
+        $self->current_user->HasRight( Object => RT->System, Right => 'SuperUser' )
+            ? ( Plugins => [ RT->Config->Get('Plugins') ] )
+            : (),
     }, { pretty => 1 });
 }
 __PACKAGE__->meta->make_immutable;
diff --git a/lib/RT/REST2/Resource/Record.pm b/lib/RT/REST2/Resource/Record.pm
index 16bc4307..17960ee0 100644
--- a/lib/RT/REST2/Resource/Record.pm
+++ b/lib/RT/REST2/Resource/Record.pm
@@ -100,10 +100,21 @@ sub resource_exists {
 
 sub forbidden {
     my $self = shift;
-    return 0 unless $self->record->id;
+    my $method = $self->request->method;
+
+    my $right_method;
+    if ( $self->record->id ) {
+        $right_method = $method =~ /^(?:GET|HEAD)$/ ? 'CurrentUserCanSee' : 'CurrentUserCanModify';
+    }
+    else {
+        # Even without id, the method can be GET, e.g. to access a not-exsting record.
+        $right_method = $method =~ /^(?:GET|HEAD)$/ ? 'CurrentUserCanSee' : 'CurrentUserCanCreate';
+    }
+
+    if ( $self->record->can($right_method) ) {
+        return !$self->record->$right_method;
+    }
 
-    my $can_see = $self->record->can("CurrentUserCanSee");
-    return 1 if $can_see and not $self->record->$can_see();
     return 0;
 }
 
diff --git a/lib/RT/REST2/Resource/Ticket.pm b/lib/RT/REST2/Resource/Ticket.pm
index 349b3dce..36872287 100644
--- a/lib/RT/REST2/Resource/Ticket.pm
+++ b/lib/RT/REST2/Resource/Ticket.pm
@@ -225,16 +225,11 @@ sub validate_input {
     if ( $args{'Action'} eq 'create' ) {
         return (0, "Could not create ticket. Queue not set", 400) if !$data->{Queue};
 
-        my $queue = RT::Queue->new(RT->SystemUser);
+        my $queue = RT::Queue->new($self->current_user);
         $queue->Load($data->{Queue});
 
-        return (0, "Unable to find queue", 400) if !$queue->Id;
-
-        return (0, $self->record->loc("No permission to create tickets in the queue '[_1]'", $queue->Name), 403)
-            unless $self->record->CurrentUser->HasRight(
-                Right  => 'CreateTicket',
-                Object => $queue,
-            ) and $queue->Disabled != 1;
+        return (0, $self->record->loc("No permission to create tickets in the queue '[_1]'", $data->{Queue}), 403)
+            unless $queue->Id and $queue->__Value('Disabled') != 1 and $queue->CurrentUserHasRight('CreateTicket');
     }
 
     if ( $args{'Action'} eq 'update' ) {
diff --git a/lib/RT/REST2/Resource/User.pm b/lib/RT/REST2/Resource/User.pm
index 2f30fc0f..f04f77eb 100644
--- a/lib/RT/REST2/Resource/User.pm
+++ b/lib/RT/REST2/Resource/User.pm
@@ -105,9 +105,8 @@ around 'serialize' => sub {
 
 sub forbidden {
     my $self = shift;
-    return 0 if not $self->record->id;
-    return 0 if $self->record->id == $self->current_user->id;
     return 0 if $self->current_user->Privileged;
+    return 0 if ( $self->record->id || 0 ) == $self->current_user->id;
     return 1;
 }
 
diff --git a/lib/RT/SearchBuilder.pm b/lib/RT/SearchBuilder.pm
index 4a740d73..e4334e71 100644
--- a/lib/RT/SearchBuilder.pm
+++ b/lib/RT/SearchBuilder.pm
@@ -1150,6 +1150,11 @@ sub DistinctFieldValues {
     return @values;
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->HasRight( Right => 'SuperUser', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/SearchBuilder/Role/Roles.pm b/lib/RT/SearchBuilder/Role/Roles.pm
index 4f80302a..42691aea 100644
--- a/lib/RT/SearchBuilder/Role/Roles.pm
+++ b/lib/RT/SearchBuilder/Role/Roles.pm
@@ -97,7 +97,7 @@ sub _RoleGroupClass {
 
 sub _RoleGroupsJoin {
     my $self = shift;
-    my %args = (New => 0, Class => '', Name => '', @_);
+    my %args = (New => 0, Class => '', Name => '', Alias => 'main', @_);
 
     $args{'Class'} ||= $self->_RoleGroupClass;
 
@@ -118,7 +118,7 @@ sub _RoleGroupsJoin {
     # Previously (before 4.4) this used an inner join.
     my $groups = $self->Join(
         TYPE            => 'left',
-        ALIAS1          => 'main',
+        ALIAS1          => $args{Alias},
         FIELD1          => $instance,
         TABLE2          => 'Groups',
         FIELD2          => 'Instance',
diff --git a/lib/RT/Ticket.pm b/lib/RT/Ticket.pm
index 10508031..dd41a44c 100644
--- a/lib/RT/Ticket.pm
+++ b/lib/RT/Ticket.pm
@@ -3761,6 +3761,10 @@ sub Serialize {
     $obj->Load( $store{EffectiveId} );
     $store{EffectiveId} = \($obj->UID);
 
+    unless ( $self->CurrentUserCanSeeTime ) {
+        delete $store{$_} for qw/TimeEstimated TimeLeft TimeWorked/;
+    }
+
     return %store;
 }
 
diff --git a/lib/RT/Tickets.pm b/lib/RT/Tickets.pm
index 1278f3b0..f0b2a4c1 100644
--- a/lib/RT/Tickets.pm
+++ b/lib/RT/Tickets.pm
@@ -2855,7 +2855,8 @@ sub CurrentUserCanSee {
             return unless @queues;
             $self->Limit(
                 SUBCLAUSE       => 'ACL',
-                ALIAS           => 'main',
+                # RT::Transactions::CurrentUserCanSee reuses RT::Tickets::CurrentUserCanSee
+                ALIAS           => $self->isa('RT::Transactions') ? $self->_JoinTickets : 'main',
                 FIELD           => 'Queue',
                 OPERATOR        => 'IN',
                 VALUE           => [ @queues ],
@@ -2875,6 +2876,8 @@ sub CurrentUserCanSee {
                     FIELD           => 'Owner',
                     VALUE           => $id,
                     ENTRYAGGREGATOR => $ea,
+                    # RT::Transactions::CurrentUserCanSee reuses RT::Tickets::CurrentUserCanSee
+                    ALIAS           => $self->isa('RT::Transactions') ? $self->_JoinTickets : 'main',
                 );
             }
             else {
@@ -3584,6 +3587,12 @@ sub Query {
     return $self->{_sql_query};
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return 1 if RT->Config->Get('UseSQLForACLChecks');
+    return $self->CurrentUser->HasRight( Right => 'ShowTicket', Object => RT->System ) ? 1 : 0;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/Transactions.pm b/lib/RT/Transactions.pm
index 6ee5697b..8d574b32 100644
--- a/lib/RT/Transactions.pm
+++ b/lib/RT/Transactions.pm
@@ -142,7 +142,28 @@ sub AddRecord {
     my $self = shift;
     my ($record) = @_;
 
-    return unless $record->CurrentUserCanSee;
+    if ( $self->{_is_ticket_only_search} && RT->Config->Get('UseSQLForACLChecks') ) {
+        # UseSQLForACLChecks implies ShowTicket only, need to check out extra rights here.
+        my $type = $record->__Value('Type');
+        if ( $type eq 'Comment' ) {
+            return unless $record->CurrentUserHasRight('ShowTicketComments');
+        }
+        elsif ( $type eq 'CommentEmailRecord' ) {
+            return
+                unless $record->CurrentUserHasRight('ShowTicketComments')
+                && $record->CurrentUserHasRight('ShowOutgoingEmail');
+        }
+        elsif ( $type eq 'EmailRecord' ) {
+            return unless $record->CurrentUserHasRight('ShowOutgoingEmail');
+        }
+        elsif ( $type eq 'CustomField' ) {
+            return unless $record->CurrentUserCanSee;
+        }
+    }
+    else {
+        return unless $record->CurrentUserCanSee;
+    }
+
     return $self->SUPER::AddRecord($record);
 }
 
@@ -1075,6 +1096,28 @@ sub _parser {
             return $self->_CloseParen unless $node->isLeaf;
         }
     );
+
+    # Determine if it's a ticket transaction search
+    $tree->traverse(
+        sub {
+            my $node = shift;
+            return unless $node->isLeaf and $node->getNodeValue;
+            my ($key, $subkey, $meta, $op, $value, $bundle)
+                = @{$node->getNodeValue}{qw/Key Subkey Meta Op Value Bundle/};
+            return unless $key eq 'ObjectType' && $value eq 'RT::Ticket' && $op eq '=';
+
+            my $is_ticket_only_search = 1;
+            while ( my $parent = $node->getParent ) {
+                last if $parent->isRoot;
+                if ( lc( $parent->getNodeValue // '' ) eq 'or' ) {
+                    $is_ticket_only_search = 0;
+                    last;
+                }
+                $node = $parent;
+            }
+            $self->{_is_ticket_only_search} ||= $is_ticket_only_search;
+        }
+    );
 }
 
 sub FromSQL {
@@ -1130,6 +1173,59 @@ sub Query {
     return $self->{_sql_query};
 }
 
+our $AUTOLOAD;
+sub AUTOLOAD {
+    my $self = shift;
+    my ($method) = ( $AUTOLOAD =~ /::(\w+)$/ );
+
+    no strict 'refs';
+
+    # Reuse RT::Tickets methods for UseSQLForACLChecks related joins/limitations.
+    if ( $self->{_is_ticket_only_search} && RT::Tickets->can($method) ) {
+        my @args = @_;
+        if ( $method eq '_RoleGroupsJoin' ) {
+            push @args, Alias => $self->_JoinTickets;
+        }
+
+        if ( $method eq '_RoleGroupClass' ) {
+            # We want ticket's role group class here
+            unshift @args, 'RT::Tickets';
+        }
+        else {
+            unshift @args, $self;
+        }
+
+        return "RT::Tickets::$method"->(@args);
+    }
+    elsif ( $method ne 'DESTROY' ) {
+        require Carp;
+        Carp::croak "Undefined subroutine &$AUTOLOAD called";
+    }
+}
+
+sub _DoSearch {
+    my $self = shift;
+    $self->CurrentUserCanSee if $self->{_is_ticket_only_search} && RT->Config->Get('UseSQLForACLChecks');
+    return $self->SUPER::_DoSearch( @_ );
+}
+
+sub _DoCount {
+    my $self = shift;
+    $self->CurrentUserCanSee if $self->{_is_ticket_only_search} && RT->Config->Get('UseSQLForACLChecks');
+    return $self->SUPER::_DoCount( @_ );
+}
+
+sub CleanSlate {
+    my $self = shift;
+    if ( $self->{_is_ticket_only_search} && RT->Config->Get('UseSQLForACLChecks') ) {
+        RT::Tickets::CleanSlate( $self, @_ ) ;
+    }
+    else {
+        $self->SUPER::CleanSlate(@_);
+    }
+    delete $self->{_is_ticket_only_search};
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/lib/RT/Users.pm b/lib/RT/Users.pm
index 33c7bbf7..2a59212a 100644
--- a/lib/RT/Users.pm
+++ b/lib/RT/Users.pm
@@ -715,6 +715,11 @@ sub SimpleSearch {
     return $self;
 }
 
+sub CurrentUserCanSeeAll {
+    my $self = shift;
+    return $self->CurrentUser->Privileged;
+}
+
 RT::Base->_ImportOverlays();
 
 1;
diff --git a/share/html/Elements/CollectionList b/share/html/Elements/CollectionList
index 6c0b8d7b..9e84f4a4 100644
--- a/share/html/Elements/CollectionList
+++ b/share/html/Elements/CollectionList
@@ -49,11 +49,7 @@
 if (!$Collection) {
     $Collection = $Class->new( $session{'CurrentUser'} );
     if ( $Class eq 'RT::Transactions' ) {
-        my @limits = ( "ObjectType = '$ObjectType'", $Query ? "($Query)" : () );
-        if ( $ObjectType eq 'RT::Ticket' ) {
-            unshift @limits, "TicketType = 'ticket'";
-        }
-        $Query = join ' AND ', @limits;
+        $Query = PreprocessTransactionSearchQuery( Query => $Query, ObjectType => $ObjectType );
     }
     $Collection->FromSQL($Query);
 }
diff --git a/share/html/REST/1.0/NoAuth/mail-gateway b/share/html/REST/1.0/NoAuth/mail-gateway
index 328be91b..107d7858 100644
--- a/share/html/REST/1.0/NoAuth/mail-gateway
+++ b/share/html/REST/1.0/NoAuth/mail-gateway
@@ -59,9 +59,18 @@ use RT::Interface::Email;
 $r->content_type('text/plain; charset=utf-8');
 $m->error_format('text');
 my ( $status, $error, $Ticket ) = RT::Interface::Email::Gateway( \%ARGS );
+
+# Obscure the message to avoid any information disclosure unless
+# in DevelMode.
+my $log_error;
+unless ( RT->Config->Get('DevelMode') ) {
+    $log_error = $error;
+    $error = 'operation unsuccessful';
+}
+
 if ( $status == 1 ) {
   $m->out("ok\n");
-  if ( $Ticket && $Ticket->Id ) {
+  if ( $Ticket && $Ticket->Id && RT->Config->Get('DevelMode') ) {
     $m->out( 'Ticket: '  . ($Ticket->Id             || '') . "\n" );
     $m->out( 'Queue: '   . ($Ticket->QueueObj->Name || '') . "\n" );
     $m->out( 'Owner: '   . ($Ticket->OwnerObj->Name || '') . "\n" );
@@ -73,9 +82,11 @@ if ( $status == 1 ) {
 }
 else {
   if ( $status == -75 ) {
+    RT->Logger->error("mail-gateway returned status -75: $log_error") if $log_error;
     $m->out( "temporary failure - $error\n" );
   }
   else {
+    RT->Logger->error("mail-gateway error: $log_error") if $log_error;
     $m->out( "not ok - $error\n" );
   }
 }
diff --git a/share/html/Search/Results.html b/share/html/Search/Results.html
index e0de84d9..30877e24 100644
--- a/share/html/Search/Results.html
+++ b/share/html/Search/Results.html
@@ -170,15 +170,9 @@ $session{$session_name} = $Class->new($session{'CurrentUser'}) ;
 my ( $ok, $msg );
 if ( $Query ) {
     if ( $Class eq 'RT::Transactions' ) {
-        my @limits = ( "ObjectType = '$ObjectType'", "($Query)" );
-        if ( $ObjectType eq 'RT::Ticket' ) {
-            unshift @limits, "TicketType = 'ticket'";
-        }
-        ( $ok, $msg ) = $session{$session_name}->FromSQL( join ' AND ', @limits );
-    }
-    else {
-        ( $ok, $msg ) = $session{$session_name}->FromSQL($Query);
+        $Query = PreprocessTransactionSearchQuery( Query => $Query, ObjectType => $ObjectType );
     }
+    ( $ok, $msg ) = $session{$session_name}->FromSQL($Query);
 }
 
 # Provide an empty search if parsing failed
diff --git a/share/html/Search/Results.tsv b/share/html/Search/Results.tsv
index 6fc595e8..dc9e80d1 100644
--- a/share/html/Search/Results.tsv
+++ b/share/html/Search/Results.tsv
@@ -61,17 +61,11 @@ my $collection = $Class->new( $session{'CurrentUser'} );
 my @limits;
 
 if ( $Class eq 'RT::Transactions' ) {
-    @limits = ( "ObjectType = '$ObjectType'", "($Query)" );
-    if ( $ObjectType eq 'RT::Ticket' ) {
-        unshift @limits, "TicketType = 'ticket'";
-    }
-}
-else {
-    push @limits, $Query;
+    $Query = PreprocessTransactionSearchQuery( Query => $Query, ObjectType => $ObjectType );
 }
 
 if ( $Query ) {
-    $collection->FromSQL( join ' AND ', @limits );
+    $collection->FromSQL( $Query );
 }
 elsif ( $Class eq 'RT::Assets' ) {
     my $catalog_obj = LoadDefaultCatalog($ARGS{'Catalog'} || '');