security fix: clone the ticket to set CurrentUser

bestpractical · May 13, 2010 · 2338cd1 · 2338cd1
1 parent 4fe4646
commit 2338cd1
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/lib/RT/Scrips_Overlay.pm b/lib/RT/Scrips_Overlay.pm
@@ -283,7 +283,10 @@ sub _SetupSourceObjects {
             TransactionObj => undef,
             @_ );
 
-    if ( ( $self->{'TicketObj'} = $args{'TicketObj'} ) ) {
+
+    if ( $args{'TicketObj'} ) {
+        # clone the ticket here as we need to change CurrentUser
+        $self->{'TicketObj'} = bless { %{$args{'TicketObj'} } }, 'RT::Ticket';
         $self->{'TicketObj'}->CurrentUser( $self->CurrentUser );
     }
     else {