Mask emails from Word docs etc.

2 files changed, 18 insertions, 2 deletions

diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb
index b169b7188..db53631c4 100644
--- a/app/controllers/request_controller.rb
+++ b/app/controllers/request_controller.rb
@@ -4,7 +4,7 @@
 # Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved.
 # Email: francis@mysociety.org; WWW: http://www.mysociety.org/
 #
-# $Id: request_controller.rb,v 1.77 2008-04-30 00:46:00 francis Exp $
+# $Id: request_controller.rb,v 1.78 2008-05-05 22:48:43 francis Exp $
 
 class RequestController < ApplicationController
     
@@ -305,6 +305,11 @@ class RequestController < ApplicationController
         @part_number = params[:part].to_i
         
         @attachment = IncomingMessage.get_attachment_by_url_part_number(@incoming_message.get_attachments_for_display, @part_number)
+
+        # Prevent spam to magic request address.
+        # XXX Bit dodgy modifying a binary like this but hey. Maybe only do for some mime types?
+        @attachment.body = @incoming_message.binary_mask_special_emails(@attachment.body) 
+
         response.content_type = 'application/octet-stream'
         if !@attachment.content_type.nil?
             response.content_type = @attachment.content_type
diff --git a/app/models/incoming_message.rb b/app/models/incoming_message.rb
index efec2885a..e2d0155ee 100644
--- a/app/models/incoming_message.rb
+++ b/app/models/incoming_message.rb
@@ -17,7 +17,7 @@
 # Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved.
 # Email: francis@mysociety.org; WWW: http://www.mysociety.org/
 #
-# $Id: incoming_message.rb,v 1.92 2008-04-30 01:19:53 francis Exp $
+# $Id: incoming_message.rb,v 1.93 2008-05-05 22:48:43 francis Exp $
 
 # TODO
 # Move some of the (e.g. quoting) functions here into rblib, as they feel
@@ -174,6 +174,17 @@ class IncomingMessage < ActiveRecord::Base
         return text
     end
 
+    # Replaces emails we know about in (possibly binary data) with equal length alternative ones.
+    def binary_mask_special_emails(text)
+        if not self.info_request.public_body.request_email.empty?
+            text = text.gsub(self.info_request.public_body.request_email, 'X' * self.info_request.public_body.request_email.size)
+        end
+        text = text.gsub(self.info_request.incoming_email, 'X' * self.info_request.incoming_email.size)
+        text = text.gsub(MySociety::Config.get("CONTACT_EMAIL", 'contact@localhost'), 'X' * MySociety::Config.get("CONTACT_EMAIL", 'contact@localhost').size)
+        text = text.gsub('Welwyn', "XXXXXX")
+        return text
+    end
+
     # Remove email addresses from text (mainly to reduce spam - particularly
     # we want to stop spam to our own magic archiving request-* addresses,
     # which would otherwise appear a lot in bounce messages and reply quotes etc.)