diff --git a/include/class.thread.php b/include/class.thread.php index 587e01349f24d1dec2308f09826da84c86fa5f5f..72f0d9a197b3c49fb23ef60ba1d1f8ae2554a176 100644 --- a/include/class.thread.php +++ b/include/class.thread.php @@ -961,6 +961,8 @@ class ThreadEntry extends VerySimpleModel { * *DEPRECATED* use Mailer::decodeMessageId() instead */ function lookupByRefMessageId($mid, $from) { + global $ost; + $mid = trim($mid, '<>'); list($ver, $ids, $mails) = explode('$', $mid, 3); @@ -972,11 +974,26 @@ class ThreadEntry extends VerySimpleModel { if (!$ids || !$ids['thread']) return false; - $thread = ThreadEntry::lookup($ids['thread']); - if (!$thread) + $entry = ThreadEntry::lookup($ids['thread']); + if (!$entry) return false; - return $thread; + // Compute the value to be compared from $mails (which used to be in + // ThreadEntry::asMessageId() + $domain = md5($ost->getConfig()->getURL()); + $ticket = $entry->getThread()->getObject(); + if (!$ticket instanceof Ticket) + return false; + + $check = sprintf('%s@%s', + substr(md5($to . $ticket->getNumber() . $ticket->getId()), -10), + substr($domain, -10) + ); + + if ($check != $mails) + return false; + + return $entry; } //new entry ... we're trusting the caller to check validity of the data.