From 1400983d8c9bace9a30b747899bd5f12cde106b8 Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sun, 11 May 2025 11:45:47 +0100
Subject: [PATCH] Projects/Tickets

- Hide new project button for users that only have support read access
- Hide new ticket button for users that only have support read access
- Enforce client access restrictions for viewing project details based off project client
- Prevent selecting the 'Select tickets' text when linking ticket
---
 modals/project_link_ticket_modal.php |  6 ++--
 project_details.php                  | 18 +++++++---
 projects.php                         | 28 ++++++++--------
 tickets.php                          | 50 +++++++++++++++-------------
 4 files changed, 57 insertions(+), 45 deletions(-)

diff --git a/modals/project_link_ticket_modal.php b/modals/project_link_ticket_modal.php
index c50e287c..e3d58322 100644
--- a/modals/project_link_ticket_modal.php
+++ b/modals/project_link_ticket_modal.php
@@ -2,7 +2,7 @@
     <div class="modal-dialog">
         <div class="modal-content bg-dark">
             <div class="modal-header">
-                <h5 class="modal-title"><i class="fas fa-fw fa-life-ring mr-2"></i>Link Ticket to Project: <strong><?php echo $project_name; ?></strong></h5>
+                <h5 class="modal-title"><i class="fas fa-fw fa-life-ring mr-2"></i>Link open ticket to project: <strong><?php echo $project_name; ?></strong></h5>
                 <button type="button" class="close text-white" data-dismiss="modal">
                     <span>&times;</span>
                 </button>
@@ -18,7 +18,7 @@
                                 <span class="input-group-text"><i class="fa fa-fw fa-life-ring"></i></span>
                             </div>
                             <select class="form-control select2" multiple name="tickets[]" required>
-                                <option value="">- Select a Tickets -</option>
+                                <option value="" disabled>- Select Ticket(s) -</option>
                                 <?php
 
                                 $sql_tickets_select = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_project_id = 0 AND ticket_closed_at IS NULL $client_ticket_select_query");
@@ -28,7 +28,7 @@
                                     $ticket_number_select = intval($row['ticket_number']);
                                     $ticket_subject_select = nullable_htmlentities($row['ticket_subject']);
                                     ?>
-                                    <option value="<?php echo $ticket_id_select; ?>"><?php echo "$ticket_prefix_select $ticket_number_select - $ticket_subject_select"; ?></option>
+                                    <option value="<?php echo $ticket_id_select; ?>"><?php echo "$ticket_prefix_select$ticket_number_select - $ticket_subject_select"; ?></option>
                                     <?php
                                 }
 
diff --git a/project_details.php b/project_details.php
index 4123bd3d..eae26b9e 100644
--- a/project_details.php
+++ b/project_details.php
@@ -13,6 +13,14 @@ if (isset($_GET['client_id'])) {
     $client_url = '';
 }
 
+// Perms & Project client access snippet
+enforceUserPermission('module_support');
+$project_permission_snippet = '';
+
+if (!empty($client_access_string)) {
+    $project_permission_snippet = "AND project_client_id IN ($client_access_string) OR project_client_id = 0";
+}
+
 if (isset($_GET['project_id'])) {
     $project_id = intval($_GET['project_id']);
 
@@ -21,7 +29,9 @@ if (isset($_GET['project_id'])) {
         "SELECT * FROM projects
         LEFT JOIN clients ON project_client_id = client_id
         LEFT JOIN users ON project_manager = user_id
-        WHERE project_id = $project_id LIMIT 1"
+        WHERE project_id = $project_id
+        $project_permission_snippet
+        LIMIT 1"
     );
 
     if (mysqli_num_rows($sql_project) == 0) {
@@ -67,10 +77,10 @@ if (isset($_GET['project_id'])) {
         $project_completed_date_display = "";
     }
 
-    // Override Tab Title // No Sanitizing needed as this var will opnly be used in the tab title
+    // Override Tab Title // No Sanitizing needed as this var will only be used in the tab title
     $tab_title = "{$row['project_prefix']}{$row['project_number']}";
     $page_title = $row['project_name'];
-    
+
     // Get Tickets
     $sql_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
@@ -218,7 +228,7 @@ if (isset($_GET['project_id'])) {
                             </button>
                             <div class="dropdown-menu">
                                 <a class="dropdown-item" href="#" data-toggle="modal" data-target="#linkTicketModal">
-                                    <i class="fas fa-fw fa-life-ring mr-2"></i>Ticket
+                                    <i class="fas fa-fw fa-life-ring mr-2"></i>Open Ticket
                                 </a>
                             </div>
                         </div>
diff --git a/projects.php b/projects.php
index 114179b4..9057747e 100644
--- a/projects.php
+++ b/projects.php
@@ -8,7 +8,7 @@ $order = "ASC";
 if (isset($_GET['client_id'])) {
     require_once "includes/inc_all_client.php";
     $client_query = "AND project_client_id = $client_id";
-    
+
     $client_url = "client_id=$client_id&";
 } else {
     require_once "includes/inc_all.php";
@@ -16,8 +16,12 @@ if (isset($_GET['client_id'])) {
     $client_url = '';
 }
 
-// Perms
+// Perms & Project client access snippet
 enforceUserPermission('module_support');
+$project_permission_snippet = '';
+if (!empty($client_access_string)) {
+    $project_permission_snippet = "AND project_client_id IN ($client_access_string) OR project_client_id = 0";
+}
 
 // Status Query
 
@@ -27,18 +31,12 @@ if (isset($_GET['status'])) {
     $status = intval($_GET['status']);
 }
 
-if($status == 1) {
+if ($status == 1) {
     $status_query = "IS NOT NULL";
 } else {
     $status_query = "IS NULL";
 }
 
-// Ticket client access snippet
-$project_permission_snippet = '';
-if (!empty($client_access_string)) {
-    $project_permission_snippet = "AND project_client_id IN ($client_access_string) OR project_client_id = 0";
-}
-
 //Rebuild URL
 $url_query_strings_sort = http_build_query($get_copy);
 
@@ -63,9 +61,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 <div class="card card-dark">
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-project-diagram mr-2"></i>Projects</h3>
-        <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addProjectModal"><i class="fas fa-plus mr-2"></i>New Project</button>
-        </div>
+        <?php if (lookupUserPermission("module_support") >= 2) { ?>
+            <div class="card-tools">
+                <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addProjectModal"><i class="fas fa-plus mr-2"></i>New Project</button>
+            </div>
+        <?php } ?>
     </div>
 
     <div class="card-body">
@@ -97,7 +97,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <i class="fa fa-fw fa-archive mr-2"></i>Archived
                             </a>
                         </div>
-                       
+
                     </div>
                 </div>
             </div>
@@ -224,7 +224,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     $sql_closed_tickets = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_project_id = $project_id AND ticket_closed_at IS NOT NULL");
 
                     $closed_ticket_count = mysqli_num_rows($sql_closed_tickets);
-                    
+
                     // Ticket Closed Percent
                     if($ticket_count) {
                         $tickets_closed_percent = round(($closed_ticket_count / $ticket_count) * 100);
diff --git a/tickets.php b/tickets.php
index a677beab..80753034 100644
--- a/tickets.php
+++ b/tickets.php
@@ -82,7 +82,7 @@ if (isset($_GET['assigned']) & !empty($_GET['assigned'])) {
         $ticket_assigned_query = 'AND ticket_assigned_to = ' . intval($_GET['assigned']);
         $ticket_assigned_filter_id = intval($_GET['assigned']);
     }
-} 
+}
 
 //Rebuild URL
 $url_query_strings_sort = http_build_query(array_merge($_GET, array('sort' => $sort, 'order' => $order, 'status' => $status, 'assigned' => $ticket_assigned_filter_id)));
@@ -172,21 +172,23 @@ $sql_categories = mysqli_query(
                     <a href="?<?php echo $client_url; ?>status=Closed" class="text-light"><strong><?php echo $total_tickets_closed; ?></strong> Closed</a>
                 </small>
             </h3>
-            <div class="card-tools">
-                <div class="btn-group">
-                    <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addTicketModal">
-                        <i class="fas fa-plus mr-2"></i>New Ticket
-                    </button>
-                    <?php if ($num_rows[0] > 0) { ?>
-                    <button type="button" class="btn btn-primary dropdown-toggle dropdown-toggle-split" data-toggle="dropdown"></button>
-                    <div class="dropdown-menu">
-                        <a class="dropdown-item text-dark" href="#" data-toggle="modal" data-target="#exportTicketModal">
-                            <i class="fa fa-fw fa-download mr-2"></i>Export
-                        </a>
+            <?php if (lookupUserPermission("module_support") >= 2) { ?>
+                <div class="card-tools">
+                    <div class="btn-group">
+                        <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addTicketModal">
+                            <i class="fas fa-plus mr-2"></i>New Ticket
+                        </button>
+                        <?php if ($num_rows[0] > 0) { ?>
+                        <button type="button" class="btn btn-primary dropdown-toggle dropdown-toggle-split" data-toggle="dropdown"></button>
+                        <div class="dropdown-menu">
+                            <a class="dropdown-item text-dark" href="#" data-toggle="modal" data-target="#exportTicketModal">
+                                <i class="fa fa-fw fa-download mr-2"></i>Export
+                            </a>
+                        </div>
+                        <?php } ?>
                     </div>
-                    <?php } ?>
                 </div>
-            </div>
+            <?php } ?>
         </div>
         <div class="card-body">
             <form autocomplete="off">
@@ -294,17 +296,17 @@ $sql_categories = mysqli_query(
                     </div>
                 </div>
 
-                <div 
-                    class="collapse 
-                        <?php 
+                <div
+                    class="collapse
+                        <?php
                         if (
-                            !empty($_GET['dtf']) 
-                            || (isset($_GET['canned_date']) && $_GET['canned_date'] !== "custom") 
-                            || (isset($_GET['status']) && is_array($_GET['status']) 
+                            !empty($_GET['dtf'])
+                            || (isset($_GET['canned_date']) && $_GET['canned_date'] !== "custom")
+                            || (isset($_GET['status']) && is_array($_GET['status'])
                             || (isset($_GET['assigned']) && $_GET['assigned']
-                        ))) 
-                            { echo "show"; } 
-                        ?>" 
+                        )))
+                            { echo "show"; }
+                        ?>"
                     id="advancedFilter"
                 >
                     <div class="row">
@@ -436,4 +438,4 @@ if (isset($_GET["view"])) {
 <?php
 require_once "modals/ticket_add_modal.php";
 require_once "modals/ticket_export_modal.php";
-require_once "includes/footer.php";
\ No newline at end of file
+require_once "includes/footer.php";