Mailing List Archive

On Wed, Oct 19, 2016 at 11:28 AM, Ram <ram0502@gmail.com> wrote:
> Hi all,
> A user at work added an attachment that violates corporate policy to a
> ticket; the ticket itself is valid and must be kept. I need to delete the
> attachment. A quick look at the rt-shredder tool does not make it apparent
> to me how to do this with rt-shredder. I can readily do it editing the db in
> mysql but I'd rather use rt-shredder if it will do the job.
> any help?

Running 4.2.12 here...

# /opt/rt4/sbin/rt-shredder --plugin list
Plugins list:
Objects
SQLDump
Summary
Tickets
Attachments
Users

So it looks like it can shred attachments.

/opt/rt4/sbin/rt-shredder --plugin help-Attachments
USAGE
masks
If any argument is marked with keyword `mask' then it means that this
argument support two special characters:

1) `*' matches any non empty sequence of the characters. For example
`*@example.com' will match any email address in `example.com' domain.

2) `?' matches exactly one character. For example `????' will match any
string four characters long.

NAME
RT::Shredder::Plugin::Attachments - search plugin for wiping
attachments.

ARGUMENTS
files_only - boolean value
Search only file attachments.

file - mask
Search files with specific file name only.

Example: '*.xl?' or '*.gif'

longer - attachment content size
Search attachments which content is longer than specified. You can use
trailing 'K' or 'M' character to specify size in kilobytes or megabytes.

Then perhaps something like:

/opt/rt4/sbin/rt-shredder --plugin
Attachments=files_only,1;file,some_secret_document.pdf

I didn't try the above and I would _for sure_ try it on a test system
first - at least a test ticket with a test attachment.

-m
---------
RT 4.4 and RTIR training sessions, and a new workshop day! https://bestpractical.com/training
* Boston - October 24-26
* Los Angeles - Q1 2017

Inline...


On Wed, Oct 19, 2016 at 9:39 AM, Matt Zagrabelny <mzagrabe@d.umn.edu> wrote:

> On Wed, Oct 19, 2016 at 11:28 AM, Ram <ram0502@gmail.com> wrote:
> > Hi all,
> > A user at work added an attachment that violates corporate policy to a
> > ticket; the ticket itself is valid and must be kept. I need to delete the
> > attachment. A quick look at the rt-shredder tool does not make it
> apparent
> > to me how to do this with rt-shredder. I can readily do it editing the
> db in
> > mysql but I'd rather use rt-shredder if it will do the job.
> > any help?
>
> Then perhaps something like:
>
> /opt/rt4/sbin/rt-shredder --plugin
> Attachments=files_only,1;file,some_secret_document.pdf
>
>
>
Thanks Matt. I did look at that - the problem is that DOC009.pdf is far
from unique in our system. What I really need is to specify the ticket id,
attachment id , or both. specifying a minimum size *might* work - I'd have
to check and see if that's the only DOC009.pdf over 75kb but I wouldn't be
surprised if there are others.

Inline..
> A user at work added an attachment that violates corporate policy to a
> ticket; the ticket itself is valid and must be kept. I need to delete the
> attachment. A quick look at the rt-shredder tool does not make it apparent
> to me how to do this with rt-shredder. I can readily do it editing the db
in
> mysql but I'd rather use rt-shredder if it will do the job.
> any help?

I'll be going with a direct DB edit which I'm documenting here for the next
person. Since I just want to suppress the file and do not want to hide the
fact that it existed. Here is what I did, be very careful! If you don't
know SQL or you don't understand every step below then find someone else to
help you - this is the WRONG PATH for you:

1 Get the attachment id of the attachment to remove (as of RT 4.4.1 it's
the *second* number in the URL that displays the attachment).

2 Add a comment to the ticket indicating that you are deleting the
offending attachment for policy violation (or whatever you motive).

3 Run this command to improve your odds of not messing up and deleting the
wrong transaction:
> select id, Transactionid, MessageId, Subject, Filename, ContentType,
ContentEncoding, Headers, Creator, Created from Attachments where id=
ATTACHMENT_ID_FROM_STEP_1 \G

4 If that looks right to you then run this SQL against A TEST COPY OF YOUR
DB to ensure you are killing the right attachment
> update Attachments set Content = NULL where id =
ATTACHMENT_ID_FROM_STEP_1 limit 1;

5 Go look at the ticket in RT and ensure that you did indeed eliminate the
offending attachment.

6 Repeat steps 3,4,5 in your production environment.

7 Do not call me if you shot yourself in the foot. No warranty expressed or
implied!

If this isn't perfectly clear, hire Best Practical (
https://bestpractical.com/) to do it for you.

cheers,

Ram

?Hello,


Sorry for not seeing this sooner, but I'll leave this for people wondering about the same in the future.

We have sucessfully deleted single attachments from a ticket using rt-shredder. Issue the command like this;

rt-shredder --plugin 'Objects=Attachment,<attachment-id>?'


We use RT 4.2.8.


Med vennlig hilsen,
Thomas Oddsund
SDS/USIT
________________________________
Fra: rt-users <rt-users-bounces@lists.bestpractical.com> på vegne av Ram <ram0502@gmail.com>
Sendt: 25. oktober 2016 01:45
Til: rt-users
Emne: Re: [rt-users] Deleting one attachment

Inline..
> A user at work added an attachment that violates corporate policy to a
> ticket; the ticket itself is valid and must be kept. I need to delete the
> attachment. A quick look at the rt-shredder tool does not make it apparent
> to me how to do this with rt-shredder. I can readily do it editing the db in
> mysql but I'd rather use rt-shredder if it will do the job.
> any help?

I'll be going with a direct DB edit which I'm documenting here for the next person. Since I just want to suppress the file and do not want to hide the fact that it existed. Here is what I did, be very careful! If you don't know SQL or you don't understand every step below then find someone else to help you - this is the WRONG PATH for you:

1 Get the attachment id of the attachment to remove (as of RT 4.4.1 it's the *second* number in the URL that displays the attachment).

2 Add a comment to the ticket indicating that you are deleting the offending attachment for policy violation (or whatever you motive).

3 Run this command to improve your odds of not messing up and deleting the wrong transaction:
> select id, Transactionid, MessageId, Subject, Filename, ContentType, ContentEncoding, Headers, Creator, Created from Attachments where id= ATTACHMENT_ID_FROM_STEP_1 \G

4 If that looks right to you then run this SQL against A TEST COPY OF YOUR DB to ensure you are killing the right attachment
> update Attachments set Content = NULL where id = ATTACHMENT_ID_FROM_STEP_1 limit 1;

5 Go look at the ticket in RT and ensure that you did indeed eliminate the offending attachment.

6 Repeat steps 3,4,5 in your production environment.

7 Do not call me if you shot yourself in the foot. No warranty expressed or implied!

If this isn't perfectly clear, hire Best Practical (https://bestpractical.com/) to do it for you.

cheers,

Ram

>
> Sorry for not seeing this sooner, but I'll leave this for people wondering
> about the same in the future.
>
> We have sucessfully deleted single attachments from a ticket using
> rt-shredder. Issue the command like this;
>
> rt-shredder --plugin 'Objects=Attachment,<attachment-id>​'
>


This is what I expected to be able to do but it's not on the web docs nor
the built-in USAGE. Guess I could've read through the code to confirm.
Thanks for follow up here Thomas!

Confirmed this works on rt 4.4.1.

br,
ram