Severity: major
Environment:
- MantisBT 2.28.4
- EmailReporting 0.15.0-DEV
- Installed core/Mail/Parser.php is byte-for-byte identical to upstream commit 5c51587a8d0373485e784e9d56675b380f1d38f1.
Impact:
This is a message-content loss issue affecting S/MIME-signed email.
EmailReporting accepts and associates the message with an issue, but the parser loses the signed message body. The import can therefore appear successful while the actual support request or reply is missing.
This is not a rejection of an untrusted certificate. The problem occurs during MIME content extraction. A test message with a cryptographically valid signature reproduced the issue.
Description:
Processing a multipart/signed email produces:
EmailReporting can't handle this mime part. Please report this to the EmailReporting project developers
Array key:
In isolated parser tests, the extracted message body is null despite the signed content containing a text/plain body.
Reproduction:
- Send the attached .eml as a message to an EmailReporting mailbox, preserving its MIME structure.
- Allow the scheduled mailbox import to process it.
- Check the EmailReporting log and the imported content.
The attachment has a cryptographically valid S/MIME signature using a self-signed test certificate. Certificate trust is not implied.
Confirmed end-to-end:
The attached message was sent through SMTP and processed by EmailReporting on 2026-11-10. It reproduced the exact warning:
Nov 10 09:51:01 madness bug_report_mail[323917]: EmailReporting can't handle this mime part. Please report this to the EmailReporting project developers
Nov 10 09:51:01 madness bug_report_mail[323917]: Array key:
The same import subsequently associated the message with the intended test issue. Body loss was independently confirmed in isolated tests using the identical parser.
Cause:
Commit 2d4141e79fea809fbe5932b230936ee02e3fab83 removed the reference parameter from:
private function parse_signed_content( &$structure )
The method removes msg_body/sig_hdr/sig_body from the shared structure object. It then assigns the merged decoded structure only to its local variable, so the caller does not receive the decoded message body.
For a signed text/plain body, an empty parts array also remains after removing the signature fields. setParts() rejects this array and prints the warning with an empty array key.
Isolated diagnostic tests:
- Original parser, signed message: exact warning; body is null.
- Unsigned multipart control: no warning; body is extracted.
- Restoring the reference parameter: body is extracted, but the warning remains.
- Additionally removing the empty parts property: body is extracted without the warning.
Tests used PHP 8.2 with the installed parser and dependencies, without loading MantisBT or accessing a mailbox.
Expected:
Import the content of signed messages completely. Successful issue association must not conceal loss of the message body.
No production code was modified. The diagnostic changes have not been validated against complex nested MIME structures. | 
