From e48420849a77630ca3db5ed4066dadbc477e5dfe Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 09:39:21 -0400
Subject: [PATCH 01/16] Fixing formatting.

---
 mailphax.rb | 29 +++++++----------------------
 1 file changed, 7 insertions(+), 22 deletions(-)

diff --git a/mailphax.rb b/mailphax.rb
index d035164..112cf1c 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -8,16 +8,7 @@
 end
 
 get '/' do
-  "Mailfax v1.0 - Visit a mail endpoint: (/sendgrid, /mandrill, /mailgun)"
-end
-
-
-get '/mandrill' do
-  [501, "mandrill not implemented yet"]
-end
-
-post '/mandrill' do
-  [501, "mandrill not implemented yet"]
+  "MailPhax v1.0 - Visit a mail endpoint: (/mailgun)"
 end
 
 get '/mailgun' do
@@ -25,7 +16,6 @@
 end
 
 post '/mailgun' do
-
   if not params['sender']
     return [400, "Must include a sender"]
   elsif not params['recipient']
@@ -37,11 +27,10 @@
 
   i = 1
   while i <= attachmentCount do
-    #add the file to the hash
     outputFile = "/tmp/#{Time.now.to_i}-#{rand(200)}-" + params["attachment-#{i}"][:filename]
 
     File.open(outputFile, "w") do |f|
-      f.write(params["attachment-#{i}"][:tempfile].read)
+      f.write(params["attachment-#{i}"][:tempfile].read())
     end
 
     files.push(outputFile)
@@ -49,14 +38,10 @@
     i += 1
   end
 
-  sendFax(params['sender'], params['recipient'],files)
+  sendFax(params['sender'], params['recipient'], files)
   "OK"
 end
 
-get '/sendgrid' do
-  [501, "sendgrid not implemented yet"]
-end
-
 def sendFax(fromEmail, toEmail, filenames)
   Phaxio.config do |config|
     config.api_key = ENV["PHAXIO_KEY"]
@@ -71,14 +56,14 @@ def sendFax(fromEmail, toEmail, filenames)
     options["filename[#{idx}]"] = File.new(filenames[idx])
   end
 
-  logger.info "#{fromEmail} is attempting to send #{filenames.length} files to #{number}..."
+  logger.info("#{fromEmail} is attempting to send #{filenames.length} files to #{number}...")
   result = Phaxio.send_fax(options)
-  result = JSON.parse result.body
+  result = JSON.parse(result.body)
 
   if result['success']
-    logger.info "Fax queued up successfully: ID #" + result['data']['faxId'].to_s
+    logger.info("Fax queued up successfully: ID #" + result['data']['faxId'].to_s)
   else
-    logger.warn "Problem submitting fax: " + result['message']
+    logger.warn("Problem submitting fax: " + result['message'])
 
     if ENV['SMTP_HOST']
       #send mail back to the user telling them there was a problem

From 51437c3570a164f91314780f9fa9f4bdb15e5e27 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 10:38:42 -0400
Subject: [PATCH 02/16] Adding some authentication to the POST request.

---
 mailphax.rb | 101 ++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 82 insertions(+), 19 deletions(-)

diff --git a/mailphax.rb b/mailphax.rb
index 112cf1c..d784d4b 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -2,8 +2,10 @@
 require 'phaxio'
 require 'mail'
 require 'pony'
+require 'tempfile'
+require 'openssl'
 
-if not ENV['PHAXIO_KEY'] or not ENV['PHAXIO_SECRET']
+if not ENV['PHAXIO_KEY'] or not ENV['PHAXIO_SECRET'] or not ENV['MAILGUN_KEY']
   raise "You must specify your phaxio API keys in PHAXIO_KEY and PHAXIO_SECRET"
 end
 
@@ -15,34 +17,95 @@
   [400, "Mailgun supported, but callbacks must be POSTs"]
 end
 
+def verifyMailgun(apiKey, token, timestamp, signature)
+  calculatedSignature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new(), apiKey, [timestamp, token].join())
+  signature == calculatedSignature
+end
+
+mailgunTokenCache = []
+
 post '/mailgun' do
-  if not params['sender']
-    return [400, "Must include a sender"]
-  elsif not params['recipient']
-    return [400, "Must include a recipient"]
+  mailgunTokenCacheMaxLength = 50
+  timestampThreshold = 30.0
+
+  sender = params['sender']
+  if not sender
+    return response(400, "Must include a sender", logger)
+  end
+
+  recipient = params['recipient']
+  if not recipient
+    return response(400, "Must include a recipient", logger)
+  end
+
+  token = params['token']
+  if not token
+    return response(400, "Must include a token", logger)
+  end
+
+  signature = params['signature']
+  if not signature
+    return response(400, "Must include a signature", logger)
+  end
+
+  timestamp = params['timestamp']
+  if not timestamp
+    return response(400, "Must include a timestamp", logger)
+  end
+
+  if mailgunTokenCache.include?(token)
+    return response(400, "duplicate token", logger)
   end
 
-  files = []
+  mailgunTokenCache.push(token)
+  while mailgunTokenCache.length() > mailgunTokenCacheMaxLength
+    mailgunTokenCache.pop()
+  end
+
+  timestampSeconds = timestamp.to_f
+  nowSeconds = Time.now().to_f
+  if (timestampSeconds - nowSeconds).abs() > timestampThreshold
+    return response(400, "timestamp unsafe", logger)
+  end
+
+  if not verifyMailgun(ENV['MAILGUN_KEY'], token, timestamp, signature)
+    return response(400, "signature does not verify", logger)
+  end
+
+  attachmentFiles = []
   attachmentCount = params['attachment-count'].to_i
 
   i = 1
   while i <= attachmentCount do
-    outputFile = "/tmp/#{Time.now.to_i}-#{rand(200)}-" + params["attachment-#{i}"][:filename]
-
-    File.open(outputFile, "w") do |f|
-      f.write(params["attachment-#{i}"][:tempfile].read())
-    end
+    tFile = Tempfile.new(params["attachment-#{i}"][:filename])
+    data = params["attachment-#{i}"][:tempfile].read()
+    tFile.write(data)
+    tFile.close()
 
-    files.push(outputFile)
+    attachmentFiles.push(tFile)
 
     i += 1
   end
 
-  sendFax(params['sender'], params['recipient'], files)
-  "OK"
+  sendFax(sender, recipient, attachmentFiles)
+
+  attachmentFiles.each do |attachmentFile|
+    begin
+      attachmentFile.unlink()
+    rescue
+      # do nothing
+    end
+  end
+
+  [200, "OK"]
+end
+
+def response(responseCode, message, logger)
+  logger.info(message)
+  return [responseCode, message]
 end
 
-def sendFax(fromEmail, toEmail, filenames)
+def sendFax(fromEmail, toEmail, attachmentFiles)
   Phaxio.config do |config|
     config.api_key = ENV["PHAXIO_KEY"]
     config.api_secret = ENV["PHAXIO_SECRET"]
@@ -52,11 +115,11 @@ def sendFax(fromEmail, toEmail, filenames)
 
   options = {to: number, callback_url: "mailto:#{fromEmail}" }
 
-  filenames.each_index do |idx|
-    options["filename[#{idx}]"] = File.new(filenames[idx])
+  attachmentFiles.each_index do |idx|
+    options["filename[#{idx}]"] = attachmentFiles[idx].path
   end
 
-  logger.info("#{fromEmail} is attempting to send #{filenames.length} files to #{number}...")
+  logger.info("#{fromEmail} is attempting to send #{attachmentFiles.length} files to #{number}...")
   result = Phaxio.send_fax(options)
   result = JSON.parse(result.body)
 
@@ -72,7 +135,7 @@ def sendFax(fromEmail, toEmail, filenames)
         :to => fromEmail,
         :from => (ENV['SMTP_FROM'] || 'mailphax@example.com'),
         :subject => 'Mailfax: There was a problem sending your fax',
-        :body => "There was a problem faxing your #{filenames.length} files to #{number}: " + result['message'],
+        :body => "There was a problem faxing your #{attachmentFiles.length} files to #{number}: " + result['message'],
         :via => :smtp,
         :via_options => {
           :address                => ENV['SMTP_HOST'],

From bcb519070a039c031b912af85c71b15d76916438 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 12:10:50 -0400
Subject: [PATCH 03/16] The plain body is now also used as an attachment.

---
 mailphax.rb | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/mailphax.rb b/mailphax.rb
index d784d4b..9354d18 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -73,8 +73,8 @@ def verifyMailgun(apiKey, token, timestamp, signature)
   end
 
   attachmentFiles = []
-  attachmentCount = params['attachment-count'].to_i
 
+  attachmentCount = params['attachment-count'].to_i
   i = 1
   while i <= attachmentCount do
     tFile = Tempfile.new(params["attachment-#{i}"][:filename])
@@ -87,6 +87,15 @@ def verifyMailgun(apiKey, token, timestamp, signature)
     i += 1
   end
 
+  if params['body-plain']
+    tFile = Tempfile.new('email-body')
+    data = params['body-plain']
+    tFile.write(data)
+    tFile.close()
+
+    attachmentFiles.push(tFile)
+  end
+
   sendFax(sender, recipient, attachmentFiles)
 
   attachmentFiles.each do |attachmentFile|

From 3839aa648edf6ab72996562a96f002b1fedde78e Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 12:29:06 -0400
Subject: [PATCH 04/16] Adding whitelisting of senders and recipients.

---
 mailphax.rb | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/mailphax.rb b/mailphax.rb
index 9354d18..e01d379 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -17,6 +17,28 @@
   [400, "Mailgun supported, but callbacks must be POSTs"]
 end
 
+$recipientWhitelist = nil
+
+def getRecipientWhitelist()
+  if $recipientWhitelist.nil?
+    if ENV['RECIPIENT_WHITELIST_FILE']
+      $recipientWhitelist = File.read(ENV['RECIPIENT_WHITELIST_FILE']).split
+    end
+  end
+  return $recipientWhitelist
+end
+
+$senderWhitelist = nil
+
+def getSenderWhitelist()
+  if $senderWhitelist.nil?
+    if ENV['SENDER_WHITELIST_FILE']
+      $senderWhitelist = File.read(ENV['SENDER_WHITELIST_FILE']).split
+    end
+  end
+  return $senderWhitelist
+end
+
 def verifyMailgun(apiKey, token, timestamp, signature)
   calculatedSignature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new(), apiKey, [timestamp, token].join())
   signature == calculatedSignature
@@ -33,11 +55,21 @@ def verifyMailgun(apiKey, token, timestamp, signature)
     return response(400, "Must include a sender", logger)
   end
 
+  senderWhitelist = getSenderWhitelist()
+  if not senderWhitelist.nil? and not senderWhitelist.include? sender
+    return response(401, "sender blocked", logger)
+  end
+
   recipient = params['recipient']
   if not recipient
     return response(400, "Must include a recipient", logger)
   end
 
+  recipientWhitelist = getRecipientWhitelist()
+  if not recipientWhitelist.nil? and not recipientWhitelist.include? recipient
+    return response(401, "recipient blocked", logger)
+  end
+
   token = params['token']
   if not token
     return response(400, "Must include a token", logger)

From 23021742f587bcc3bbea3f12045ae362e9bec354 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 13:21:21 -0400
Subject: [PATCH 05/16] Renaming function.

---
 mailphax.rb | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/mailphax.rb b/mailphax.rb
index e01d379..171959d 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -52,41 +52,41 @@ def verifyMailgun(apiKey, token, timestamp, signature)
 
   sender = params['sender']
   if not sender
-    return response(400, "Must include a sender", logger)
+    return logAndResponse(400, "Must include a sender", logger)
   end
 
   senderWhitelist = getSenderWhitelist()
   if not senderWhitelist.nil? and not senderWhitelist.include? sender
-    return response(401, "sender blocked", logger)
+    return logAndResponse(401, "sender blocked", logger)
   end
 
   recipient = params['recipient']
   if not recipient
-    return response(400, "Must include a recipient", logger)
+    return logAndResponse(400, "Must include a recipient", logger)
   end
 
   recipientWhitelist = getRecipientWhitelist()
   if not recipientWhitelist.nil? and not recipientWhitelist.include? recipient
-    return response(401, "recipient blocked", logger)
+    return logAndResponse(401, "recipient blocked", logger)
   end
 
   token = params['token']
   if not token
-    return response(400, "Must include a token", logger)
+    return logAndResponse(400, "Must include a token", logger)
   end
 
   signature = params['signature']
   if not signature
-    return response(400, "Must include a signature", logger)
+    return logAndResponse(400, "Must include a signature", logger)
   end
 
   timestamp = params['timestamp']
   if not timestamp
-    return response(400, "Must include a timestamp", logger)
+    return logAndResponse(400, "Must include a timestamp", logger)
   end
 
   if mailgunTokenCache.include?(token)
-    return response(400, "duplicate token", logger)
+    return logAndResponse(400, "duplicate token", logger)
   end
 
   mailgunTokenCache.push(token)
@@ -97,11 +97,11 @@ def verifyMailgun(apiKey, token, timestamp, signature)
   timestampSeconds = timestamp.to_f
   nowSeconds = Time.now().to_f
   if (timestampSeconds - nowSeconds).abs() > timestampThreshold
-    return response(400, "timestamp unsafe", logger)
+    return logAndResponse(400, "timestamp unsafe", logger)
   end
 
   if not verifyMailgun(ENV['MAILGUN_KEY'], token, timestamp, signature)
-    return response(400, "signature does not verify", logger)
+    return logAndResponse(400, "signature does not verify", logger)
   end
 
   attachmentFiles = []
@@ -141,7 +141,7 @@ def verifyMailgun(apiKey, token, timestamp, signature)
   [200, "OK"]
 end
 
-def response(responseCode, message, logger)
+def logAndResponse(responseCode, message, logger)
   logger.info(message)
   return [responseCode, message]
 end

From d83946102b431f1a2f0ddf695667758cf68a12f0 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 13:49:51 -0400
Subject: [PATCH 06/16] Adding an option to use regular expressions to ensure
 the body is acceptable

---
 Gemfile      |  5 +++--
 Gemfile.lock |  7 ++++++-
 mailphax.rb  | 27 ++++++++++++++++++++++-----
 3 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/Gemfile b/Gemfile
index 0287d04..2f88cb3 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,7 +1,8 @@
 source 'https://rubygems.org'
-ruby '2.0.0'
+ruby '2.3.0'
 
 gem 'sinatra'
 gem 'phaxio'
 gem 'mail'
-gem 'pony'
\ No newline at end of file
+gem 'pony'
+gem 'to_regexp'
\ No newline at end of file
diff --git a/Gemfile.lock b/Gemfile.lock
index a0c56ef..19e9c70 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -7,7 +7,7 @@ GEM
     httparty (0.13.0)
       json (~> 1.8)
       multi_xml (>= 0.5.2)
-    json (1.8.1)
+    json (1.8.2)
     mail (2.6.1)
       mime-types (>= 1.16, < 3)
     mime-types (2.3)
@@ -25,6 +25,7 @@ GEM
       rack-protection (~> 1.4)
       tilt (~> 1.3, >= 1.3.4)
     tilt (1.4.1)
+    to_regexp (0.2.1)
 
 PLATFORMS
   ruby
@@ -34,3 +35,7 @@ DEPENDENCIES
   phaxio
   pony
   sinatra
+  to_regexp
+
+BUNDLED WITH
+   1.11.2
diff --git a/mailphax.rb b/mailphax.rb
index 171959d..0c284dd 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -4,6 +4,7 @@
 require 'pony'
 require 'tempfile'
 require 'openssl'
+require 'to_regexp'
 
 if not ENV['PHAXIO_KEY'] or not ENV['PHAXIO_SECRET'] or not ENV['MAILGUN_KEY']
   raise "You must specify your phaxio API keys in PHAXIO_KEY and PHAXIO_SECRET"
@@ -39,6 +40,17 @@ def getSenderWhitelist()
   return $senderWhitelist
 end
 
+$bodyRegex = nil
+
+def getBodyRegex()
+  if $bodyRegex.nil?
+    if ENV['BODY_REGEX']
+      $bodyRegex = ENV['BODY_REGEX'].to_regexp
+    end
+  end
+  return $bodyRegex
+end
+
 def verifyMailgun(apiKey, token, timestamp, signature)
   calculatedSignature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new(), apiKey, [timestamp, token].join())
   signature == calculatedSignature
@@ -120,12 +132,17 @@ def verifyMailgun(apiKey, token, timestamp, signature)
   end
 
   if params['body-plain']
-    tFile = Tempfile.new('email-body')
     data = params['body-plain']
-    tFile.write(data)
-    tFile.close()
-
-    attachmentFiles.push(tFile)
+    bodyRegex = getBodyRegex()
+    if bodyRegex.nil? or bodyRegex.match(data)
+      tFile = Tempfile.new('email-body')
+      tFile.write(data)
+      tFile.close()
+
+      attachmentFiles.push(tFile)
+    else
+      return logAndResponse(401, "body not accepted", logger)
+    end
   end
 
   sendFax(sender, recipient, attachmentFiles)

From 690cfaa1041dc2afa9a482514f0e6582d37a8b09 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 15:58:45 -0400
Subject: [PATCH 07/16] Removing instructions for unimplemented features from
 README

---
 README.md | 47 -----------------------------------------------
 1 file changed, 47 deletions(-)

diff --git a/README.md b/README.md
index 5ef51b2..fccad3b 100644
--- a/README.md
+++ b/README.md
@@ -3,26 +3,6 @@ Mailphax
 
 Send faxes with Phaxio using 3rd party email services.  Mailphax is a simple sinatra app.  You can run it on any host or with any service that supports ruby and sinatra.
 
-
-Installation on Heroku
-------------
-
-**Use the deploy button**
-
-[![Deploy](https://www.herokucdn.com/deploy/button.png)](https://heroku.com/deploy)
-
-**Or do it yourself**
-
-(This assumes you have the Heroku toolbelt installed and have a Heroku account.)
-
-1. git clone this repo && cd mailphax
-1. heroku create
-1. heroku config:set PHAXIO_KEY=yourPhaxioApiKey
-1. heroku config:set PHAXIO_SECRET=yourPhaxioApiSecret
-1. git push heroku master
-
-Now set up your hosted email service to invoke callbacks to this service when mail is received.  (See below.)
-
 Configuring Mailgun
 -------
 1. Sign up for a mailgun account
@@ -36,30 +16,3 @@ Configuring Mailgun
 1. For "Actions" specify "forward("http://yourMailPhaxInstallation/mailgun")" where yourMailPhaxInstallation should be the location where you've installed the sinatra app.
 1. Click "Save".
 1. Profit.
-
-
-Configuring Mandrill
---------------------
-
-1. Sign up for a mandrill account
-1. In the Mandrill console, click "Inbound" in the left sidebar.
-1. Add a new inbound domain that you have DNS control over.
-1. Modify the DNS on your inbound domain to point to Mandrill using MX records. (Click the "DNS Settings" button for more info.)
-1. Click "Routes" in the Mandrill console under your new inbound domain.
-1. Add a wildcard route "*" and point it to http://yourMailPhaxInstallation/mandrill (e.g. http://example.com/mandrill)
-1. Profit.
-
-
-Configuring SendGrid
--------
-TODO
-
-
-TODOs
------
-
- - Support SendGrid
- - Reply to user with confirmation of fax success/failure
- - Reply to user if fax submission failed (e.g. bad number, no attachment)
- - Allow filtering inbound emails by regexes
- 

From e3308cc86c79cd1d6fa38c11d4eaa32614c50b55 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 15:59:18 -0400
Subject: [PATCH 08/16] Changing exception text when environment variables
 aren't set

---
 mailphax.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mailphax.rb b/mailphax.rb
index 0c284dd..02a75ab 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -7,7 +7,7 @@
 require 'to_regexp'
 
 if not ENV['PHAXIO_KEY'] or not ENV['PHAXIO_SECRET'] or not ENV['MAILGUN_KEY']
-  raise "You must specify your phaxio API keys in PHAXIO_KEY and PHAXIO_SECRET"
+  raise "You must specify the required environment variables"
 end
 
 get '/' do

From 1f55792fc2c4248552855b1a5d53fdbeacb9ab2b Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 17:54:58 -0400
Subject: [PATCH 09/16] Fixing wrong type.

---
 mailphax.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mailphax.rb b/mailphax.rb
index 02a75ab..6378a06 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -126,6 +126,7 @@ def verifyMailgun(apiKey, token, timestamp, signature)
     tFile.write(data)
     tFile.close()
 
+    # use the whole file to ensure GC cannot release it yet
     attachmentFiles.push(tFile)
 
     i += 1
@@ -139,6 +140,7 @@ def verifyMailgun(apiKey, token, timestamp, signature)
       tFile.write(data)
       tFile.close()
 
+      # use the whole file to ensure GC cannot release it yet
       attachmentFiles.push(tFile)
     else
       return logAndResponse(401, "body not accepted", logger)
@@ -174,7 +176,7 @@ def sendFax(fromEmail, toEmail, attachmentFiles)
   options = {to: number, callback_url: "mailto:#{fromEmail}" }
 
   attachmentFiles.each_index do |idx|
-    options["filename[#{idx}]"] = attachmentFiles[idx].path
+    options["filename[#{idx}]"] = File.new(attachmentFiles[idx].path)
   end
 
   logger.info("#{fromEmail} is attempting to send #{attachmentFiles.length} files to #{number}...")

From b40e41b01fb51fc8466b8e4bc2b38db6b31e0c60 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 18:03:34 -0400
Subject: [PATCH 10/16] Ensuring the file extension is at the end.

---
 mailphax.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mailphax.rb b/mailphax.rb
index 6378a06..42cd09e 100644
--- a/mailphax.rb
+++ b/mailphax.rb
@@ -121,7 +121,7 @@ def verifyMailgun(apiKey, token, timestamp, signature)
   attachmentCount = params['attachment-count'].to_i
   i = 1
   while i <= attachmentCount do
-    tFile = Tempfile.new(params["attachment-#{i}"][:filename])
+    tFile = Tempfile.new(['', params["attachment-#{i}"][:filename]])
     data = params["attachment-#{i}"][:tempfile].read()
     tFile.write(data)
     tFile.close()
@@ -136,7 +136,7 @@ def verifyMailgun(apiKey, token, timestamp, signature)
     data = params['body-plain']
     bodyRegex = getBodyRegex()
     if bodyRegex.nil? or bodyRegex.match(data)
-      tFile = Tempfile.new('email-body')
+      tFile = Tempfile.new(['', 'email-body.txt'])
       tFile.write(data)
       tFile.close()
 

From 79e96f84858931f17ff8d04aad61a5a4171a6047 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Fri, 15 Apr 2016 23:13:51 -0400
Subject: [PATCH 11/16] Adding to app.json the newly introduced environment
 variables

---
 app.json | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/app.json b/app.json
index f2be2cd..209ac5a 100644
--- a/app.json
+++ b/app.json
@@ -17,6 +17,21 @@
     "PHAXIO_SECRET": {
       "description": "Your Phaxio API Secret"
     },
+    "MAILGUN_KEY": {
+      "description": "Your Mailgun API Key"
+    },
+    "RECIPIENT_WHITELIST_FILE": {
+      "description": "File path to newline-separated list of whitelisted emails of recipients",
+      "required": false
+    },
+    "SENDER_WHITELIST_FILE": {
+      "description": "File path to newline-separated list of whitelisted emails of senders",
+      "required": false
+    },
+    "BODY_REGEX": {
+      "description": "Ruby Regexp string (of form '/{regex string}/{regex arguments}') to match against email body",
+      "required": false
+    },
     "SMTP_HOST": {
       "description": "SMTP host for outgoing email (for failure alerts)",
       "required": false

From 235dea560f0cf83b11f6202761f1eb5f25f2032e Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Wed, 18 Jan 2017 11:58:19 -0500
Subject: [PATCH 12/16] Adding a script template.

---
 start_mailphax_server.sh.template | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 start_mailphax_server.sh.template

diff --git a/start_mailphax_server.sh.template b/start_mailphax_server.sh.template
new file mode 100644
index 0000000..5a435e8
--- /dev/null
+++ b/start_mailphax_server.sh.template
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+export PHAXIO_KEY='##PHAXIO API KEY##'
+export PHAXIO_SECRET='##PHAXIO SECRET KEY##'
+export MAILGUN_KEY='##MAILGUN API KEY##'
+
+# see app.json for more available environment variables
+
+cd /path/to/mailphax/git/repo/
+ruby mailphax.rb

From c4863f5aee6bb552ecb61e37eea05357a241d763 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <mchristopherson@tradewind.aero>
Date: Wed, 18 Jan 2017 12:01:27 -0500
Subject: [PATCH 13/16] Adding script to .gitignore

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 93bf608..cb58e60 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 .idea
 Rack*
+start_mailphax_server.sh
+

From e8fbab7490f8c223c474c26769b0bd1d6b854659 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <mchristopherson@tradewind.aero>
Date: Wed, 18 Jan 2017 12:03:21 -0500
Subject: [PATCH 14/16] Adding executable flag to script template

---
 start_mailphax_server.sh.template | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 start_mailphax_server.sh.template

diff --git a/start_mailphax_server.sh.template b/start_mailphax_server.sh.template
old mode 100644
new mode 100755

From 98df53c1b0d7a8bbde722c232e2ea68c741bf0ef Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Wed, 18 Jan 2017 12:11:03 -0500
Subject: [PATCH 15/16] Changing to use `rackup` for server.

---
 start_mailphax_server.sh.template | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/start_mailphax_server.sh.template b/start_mailphax_server.sh.template
index 5a435e8..7524021 100755
--- a/start_mailphax_server.sh.template
+++ b/start_mailphax_server.sh.template
@@ -1,5 +1,9 @@
 #!/bin/bash
 
+PORT=8080
+HOST='0.0.0.0'
+ENVIRONMENT='production'
+
 export PHAXIO_KEY='##PHAXIO API KEY##'
 export PHAXIO_SECRET='##PHAXIO SECRET KEY##'
 export MAILGUN_KEY='##MAILGUN API KEY##'
@@ -7,4 +11,4 @@ export MAILGUN_KEY='##MAILGUN API KEY##'
 # see app.json for more available environment variables
 
 cd /path/to/mailphax/git/repo/
-ruby mailphax.rb
+rackup -p $PORT -o $HOST -E $ENVIRONMENT

From 9c5eff6a63961660f9bb4d5ea23561fb7a97d067 Mon Sep 17 00:00:00 2001
From: Murray Christopherson <murraychristopherson@gmail.com>
Date: Wed, 18 Jan 2017 12:13:10 -0500
Subject: [PATCH 16/16] Ensure RVM is used for Ruby version.

---
 start_mailphax_server.sh.template | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/start_mailphax_server.sh.template b/start_mailphax_server.sh.template
index 7524021..464778c 100755
--- a/start_mailphax_server.sh.template
+++ b/start_mailphax_server.sh.template
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+source /usr/local/rvm/scripts/rvm
+
 PORT=8080
 HOST='0.0.0.0'
 ENVIRONMENT='production'