Create a script to set SHA for existing image attachments

configure.ac

@@ -468,6 +468,7 @@ AC_CONFIG_FILES([
                  etc/upgrade/time-worked-history
                  etc/upgrade/upgrade-articles
                  etc/upgrade/upgrade-assets
+                 etc/upgrade/upgrade-attachment-image-sha
                  etc/upgrade/upgrade-authtokens
                  etc/upgrade/upgrade-configurations
                  etc/upgrade/vulnerable-passwords

etc/upgrade/upgrade-attachment-image-sha.in

@@ -0,0 +1,134 @@
+#!@PERL@
+# BEGIN BPS TAGGED BLOCK {{{
+#
+# COPYRIGHT:
+#
+# This software is Copyright (c) 1996-2024 Best Practical Solutions, LLC
+#                                          <[email protected]>
+#
+# (Except where explicitly superseded by other copyright notices)
+#
+#
+# LICENSE:
+#
+# This work is made available to you under the terms of Version 2 of
+# the GNU General Public License. A copy of that license should have
+# been provided with this software, but in any event can be snarfed
+# from www.gnu.org.
+#
+# This work is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301 or visit their web page on the internet at
+# http://www.gnu.org/licenses/old-licenses/gpl-2.0.html.
+#
+#
+# CONTRIBUTION SUBMISSION POLICY:
+#
+# (The following paragraph is not intended to limit the rights granted
+# to you to modify and distribute this software under the terms of
+# the GNU General Public License and is only of importance to you if
+# you choose to contribute your changes and enhancements to the
+# community by submitting them to Best Practical Solutions, LLC.)
+#
+# By intentionally submitting any modifications, corrections or
+# derivatives to this work, or any other work intended for use with
+# Request Tracker, to Best Practical Solutions, LLC, you confirm that
+# you are the copyright holder for those contributions and you grant
+# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
+# royalty-free, perpetual, license to use, copy, create derivative
+# works based on those contributions, and sublicense and distribute
+# those contributions and any derivatives thereof.
+#
+# END BPS TAGGED BLOCK }}}
+use 5.10.1;
+use strict;
+use warnings;
+
+# fix lib paths, some may be relative
+BEGIN { # BEGIN RT CMD BOILERPLATE
+    require File::Spec;
+    require Cwd;
+    my @libs = ("@RT_LIB_PATH@", "@LOCAL_LIB_PATH@");
+    my $bin_path;
+
+    for my $lib (@libs) {
+        unless ( File::Spec->file_name_is_absolute($lib) ) {
+            $bin_path ||= ( File::Spec->splitpath(Cwd::abs_path(__FILE__)) )[1];
+            $lib = File::Spec->catfile( $bin_path, File::Spec->updir, $lib );
+        }
+        unshift @INC, $lib;
+    }
+
+}
+
+use RT::Interface::CLI qw(GetCurrentUser Init);
+my %opt = ( update => 0 );
+Init( \%opt, 'update!' );
+
+use RT::Attachments;
+my $attachments = RT::Attachments->new( RT->SystemUser );
+$attachments->Limit(
+    FIELD => 'ContentType',
+    OPERATOR => 'STARTSWITH',
+    VALUE => 'image/',
+    ENTRYAGGREGATOR => 'AND',
+);
+$attachments->Limit(
+    FIELD => 'SHA',
+    OPERATOR => 'IS',
+    VALUE => 'NULL',
+    ENTRYAGGREGATOR => 'AND',
+);
+
+my $count = $attachments->Count;
+$attachments->RowsPerPage(10);
+$attachments->RedoSearch;
+$attachments->FirstPage;
+
+
+while ( my $test = $attachments->Next ) {
+    print "got: " . $test->Id . "\n";
+}
+
+
+if ($count == 0) {
+    print "No attachments with missing SHAs found.\n";
+    exit 0;
+}
+
+if ($opt{update}) {
+    print "Upgrading $count attachments...\n";
+    FetchNext( $attachments, 'init' );
+    while ( my $attachment = FetchNext($attachments) ) {
+        $attachment->SetSHA();
+    }
+    print "Done.\n";
+    exit 0;
+} else {
+    print "$count attachments found with no SHA stored\n";
+
+    print "\n", "Run again with --update to run the update.\n";
+    exit 1;
+}
+
+use constant PAGE_SIZE => 1000;
+sub FetchNext {
+    my ( $objs, $init ) = @_;
+    if ($init) {
+        $objs->RowsPerPage(PAGE_SIZE);
+        $objs->FirstPage;
+        return;
+    }
+
+    my $obj = $objs->Next;
+    return $obj if $obj;
+    $objs->RedoSearch;
+    $objs->FirstPage;
+    return $objs->Next;
+}

lib/RT/Attachment.pm

@@ -1320,6 +1320,37 @@ Returns the current value of Created.
 
 =cut
 
+=head2 SetSHA
+
+Set the SHA column with a SHA 256 hash based on the content.
+
+This is only used for image type attachments. It assumes the
+attachment record already has a store image in Content.
+
+=cut
+
+sub SetSHA {
+    my $self  = shift;
+
+    unless ( $self->ContentType =~ /^image\// ) {
+        RT->Logger->error("Can only set SHA for attachments with image content type");
+        return;
+    }
+
+    # We want the content without calling DecodeLOB to be consistent
+    # with the SHA we generate on Create, which is after EncodeLOB.
+    my $content = $self->_Value('Content', decode_utf8 => 0);
+
+    unless ( $content && length $content ) {
+        RT->Logger->error("No content found");
+        return;
+    }
+
+    return $self->_Set(
+        Field => "SHA",
+        Value => Digest::SHA::sha256_hex($content),
+    );
+}
 
 
 sub _CoreAccessible {