Adjust text in issue status header

Show that issue was created by user with address
taken from the From header, but the replies will go to
email address taken from the Reply-To header.

doc/user/project/service_desk.md

@@ -330,6 +330,20 @@ Note that:
 - The project's visibility (private, internal, public) does not affect Service Desk.
 - The path to the project, including its group or namespace, is shown in emails.
 
+#### Issues created on someone's behalf
+
+To allow third party applications and ticketing systems to interface with Service Desk,
+when the email contains the `Reply-To` email header, this email address is used as the address of the
+issue author.
+
+Because the `Reply-To` header can be set to arbitrary values, do not blindly trust that an issue
+created on behalf of `someone@example.com` was indeed created by the real owner of such email address.
+
+For example, an email with headers `To: support@example.com` and `Reply-To:someone@example.com`
+creates an issue with the following note:
+
+> Created (…) by `support@example.com` (reply to: `someone@example.com`) (…)
+
 #### Privacy considerations
 
 Service Desk issues are confidential, but the project owner can

lib/gitlab/email/handler/service_desk_handler.rb

@@ -34,7 +34,7 @@ module Gitlab
 
           create_issue_or_note
 
-          if from_address
+          if issue_creator_address
             add_email_participant
             send_thank_you_email unless reply_email?
           end
@@ -98,7 +98,7 @@ module Gitlab
               title: mail.subject,
               description: message_including_template,
               confidential: true,
-              external_author: from_address
+              external_author: external_author
             },
             spam_params: nil
           ).execute
@@ -176,8 +176,22 @@ module Gitlab
           ).execute
         end
 
+        def issue_creator_address
+          reply_to_address || from_address
+        end
+
         def from_address
-          (mail.reply_to || []).first || mail.from.first || mail.sender
+          mail.from.first || mail.sender
+        end
+
+        def reply_to_address
+          (mail.reply_to || []).first
+        end
+
+        def external_author
+          return issue_creator_address unless reply_to_address && from_address
+
+          _("%{from_address} (reply to: %{reply_to_address})") % { from_address: from_address, reply_to_address: reply_to_address }
         end
 
         def can_handle_legacy_format?
@@ -191,7 +205,7 @@ module Gitlab
         def add_email_participant
           return if reply_email? && !Feature.enabled?(:issue_email_participants, @issue.project)
 
-          @issue.issue_email_participants.create(email: from_address)
+          @issue.issue_email_participants.create(email: issue_creator_address)
         end
       end
     end

locale/gitlab.pot

@@ -663,6 +663,9 @@ msgstr ""
 msgid "%{firstMilestoneName} + %{numberOfOtherMilestones} more"
 msgstr ""
 
+msgid "%{from_address} (reply to: %{reply_to_address})"
+msgstr ""
+
 msgid "%{gitlab_experience_text}. Don't worry, this information isn't shared outside of your self-managed GitLab instance."
 msgstr ""
 

spec/fixtures/emails/service_desk_reply_to_and_from.eml

+Delivered-To: incoming+email-test-project_id-issue-@appmail.adventuretime.ooo
+Return-Path: <jake@adventuretime.ooo>
+Received: from iceking.adventuretime.ooo ([unix socket]) by iceking (Cyrus v2.2.13-Debian-2.2.13-19+squeeze3) with LMTPA; Thu, 13 Jun 2013 17:03:50 -0400
+Received: from mail-ie0-x234.google.com (mail-ie0-x234.google.com [IPv6:2607:f8b0:4001:c03::234]) by iceking.adventuretime.ooo (8.14.3/8.14.3/Debian-9.4) with ESMTP id r5DL3nFJ016967 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <incoming+gitlabhq/gitlabhq@appmail.adventuretime.ooo>; Thu, 13 Jun 2013 17:03:50 -0400
+Received: by mail-ie0-f180.google.com with SMTP id f4so21977375iea.25 for <incoming+email-test-project_id-issue-@appmail.adventuretime.ooo>; Thu, 13 Jun 2013 14:03:48 -0700
+Received: by 10.0.0.1 with HTTP; Thu, 13 Jun 2013 14:03:48 -0700
+Date: Thu, 13 Jun 2013 17:03:48 -0400
+Reply-To: Marceline <marceline@adventuretime.ooo>
+From: Finn the Human <finn@adventuretime.ooo>
+Sender: Jake the Dog <jake@adventuretime.ooo>
+To: support@adventuretime.ooo
+Delivered-To: support@adventuretime.ooo
+Message-ID: <CADkmRc+rNGAGGbV2iE5p918UVy4UyJqVcXRO2=otppgzduJSg@mail.gmail.com>
+Subject: The message subject! @all
+Mime-Version: 1.0
+Content-Type: text/plain;
+ charset=ISO-8859-1
+Content-Transfer-Encoding: 7bit
+X-Sieve: CMU Sieve 2.2
+X-Received: by 10.0.0.1 with SMTP id n7mr11234144ipb.85.1371157428600; Thu,
+ 13 Jun 2013 14:03:48 -0700 (PDT)
+X-Scanned-By: MIMEDefang 2.69 on IPv6:2001:470:1d:165::1
+
+Service desk stuff!
+
+```
+a = b
+```

spec/lib/gitlab/email/handler/service_desk_handler_spec.rb

@@ -477,6 +477,20 @@ RSpec.describe Gitlab::Email::Handler::ServiceDeskHandler do
       end
     end
 
+    context 'when there is a reply-to address and a from address' do
+      let(:email_raw) { email_fixture('emails/service_desk_reply_to_and_from.eml') }
+
+      it 'shows both from and reply-to addresses in the issue header' do
+        setup_attachment
+
+        expect { receiver.execute }.to change { Issue.count }.by(1)
+
+        new_issue = Issue.last
+
+        expect(new_issue.external_author).to eq('finn@adventuretime.ooo (reply to: marceline@adventuretime.ooo)')
+      end
+    end
+
     context 'when service desk is not enabled for project' do
       before do
         allow(Gitlab::ServiceDesk).to receive(:enabled?).and_return(false)