From a0cd266c8bda538f36096787c1693383a3405b4e Mon Sep 17 00:00:00 2001
From: Andrew Malsbury <andymalsb@gmail.com>
Date: Tue, 14 Nov 2023 15:53:04 +0000
Subject: [PATCH 1/5] Add Client-Replied to ticket sort dropdown

---
 tickets.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tickets.php b/tickets.php
index 16e2ac8e..0ecdae08 100644
--- a/tickets.php
+++ b/tickets.php
@@ -33,6 +33,9 @@ if (!isset($_GET['status'])) {
 } elseif (isset($_GET['status']) && ($_GET['status']) == 'Closed') {
     $status = 'Closed';
     $ticket_status_snippet = "ticket_status = 'Closed'";
+} else if (isset($_GET['status']) && ($_GET['status']) == 'Client-Replied') {
+    $status = 'Client-Replied';
+    $ticket_status_snippet = "ticket_status = 'Client-Replied'";
 } else {
     $status = '%';
     $ticket_status_snippet = "ticket_status LIKE '%'";
@@ -207,6 +210,7 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']);
                                 <select class="form-control select2" name="status">
                                     <option value="%" <?php if ($status == "%") {echo "selected";}?> >Any</option>
                                     <option value="In-Progress" <?php if ($status == "In-Progress") {echo "selected";}?> >In-Progress</option>
+                                    <option value="Client-Replied" <?php if ($status == "Client-Replied") {echo "selected";}?> >Client-Replied</option>
                                     <option value="Pending-Client" <?php if ($status == "Pending-Client") {echo "selected";}?> >Pending-Client</option>
                                     <option value="Pending-Vendor" <?php if ($status == "Pending-Vendor") {echo "selected";}?> >Pending-Vendor</option>
                                     <option value="Pending-Shipment" <?php if ($status == "Pending-Shipment") {echo "selected";}?> >Pending-Shipment</option>

From 1d401874f38ae4208d6fedf1ff683edab60dc9c4 Mon Sep 17 00:00:00 2001
From: Andrew Malsbury <andymalsb@gmail.com>
Date: Tue, 14 Nov 2023 17:09:43 +0000
Subject: [PATCH 2/5] Update to select2 multiple statuses.

---
 tickets.php | 78 +++++++++++++++++++++++++----------------------------
 1 file changed, 36 insertions(+), 42 deletions(-)

diff --git a/tickets.php b/tickets.php
index 0ecdae08..3307774a 100644
--- a/tickets.php
+++ b/tickets.php
@@ -6,39 +6,28 @@ $order = "DESC";
 
 require_once "inc_all.php";
 
+// Get Statuses from DB
+$statuses = array();
+$query = "SELECT DISTINCT ticket_status FROM tickets ORDER BY ticket_status";
+$result = mysqli_query($mysqli, $query);
+while ($row = mysqli_fetch_assoc($result)) {
+    $statuses[] = $row['ticket_status'];
+}
 
-// Ticket status from GET
-if (!isset($_GET['status'])) {
-    // If nothing is set, assume we only want to see open tickets
-    $status = 'Open';
-    $ticket_status_snippet = "ticket_status != 'Closed'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'Open') {
-    $status = 'Open';
-    $ticket_status_snippet = "ticket_status != 'Closed'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'In-Progress') {
-    $status = 'In-Progress';
-    $ticket_status_snippet = "ticket_status = 'In-Progress'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'Pending-Client') {
-    $status = 'Pending-Client';
-    $ticket_status_snippet = "ticket_status = 'Pending-Client'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'Pending-Vendor') {
-    $status = 'Pending-Vendor';
-    $ticket_status_snippet = "ticket_status = 'Pending-Vendor'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'Pending-Shipment') {
-    $status = 'Pending-Shipment';
-    $ticket_status_snippet = "ticket_status = 'Pending-Shipment'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'Scheduled') {
-    $status = 'Scheduled';
-    $ticket_status_snippet = "ticket_status = 'Scheduled'";
-} elseif (isset($_GET['status']) && ($_GET['status']) == 'Closed') {
-    $status = 'Closed';
-    $ticket_status_snippet = "ticket_status = 'Closed'";
-} else if (isset($_GET['status']) && ($_GET['status']) == 'Client-Replied') {
-    $status = 'Client-Replied';
-    $ticket_status_snippet = "ticket_status = 'Client-Replied'";
+// Set Ticket statuses sort
+if (isset($_GET['status']) && !empty($_GET['status'])) {
+    $ticket_statuses = $_GET['status'];
+    $ticket_status_clause = "ticket_status != 'Closed'";
 } else {
-    $status = '%';
-    $ticket_status_snippet = "ticket_status LIKE '%'";
+    $ticekt_status = "Open";
+    $ticket_status_clause = "ticket_status IN ('" . implode("','", $ticket_statuses) . "')";
+}
+
+// Make array no matter if one or none items selected.
+if (!empty($_GET['status'])) {
+    $ticket_statuses = is_array($_GET['status']) ? $_GET['status'] : array($_GET['status']);
+} else {
+    $ticket_statuses = array();
 }
 
 // Ticket assignment status filter
@@ -53,8 +42,9 @@ if (isset($_GET['assigned']) & !empty($_GET['assigned'])) {
     $ticket_assigned_filter = '';
 }
 
+
 //Rebuild URL
-$url_query_strings_sort = http_build_query(array_merge($_GET, array('sort' => $sort, 'order' => $order, 'status' => $status, 'assigned' => $ticket_assigned_filter)));
+$url_query_strings_sort = http_build_query(array_merge($_GET, array('sort' => $sort, 'order' => $order, 'status[]' => $ticket_statuses, 'assigned' => $ticket_assigned_filter)));
 
 // Main ticket query:
 $sql = mysqli_query(
@@ -67,7 +57,7 @@ $sql = mysqli_query(
     LEFT JOIN locations ON ticket_location_id = location_id
     LEFT JOIN vendors ON ticket_vendor_id = vendor_id
     WHERE ticket_assigned_to LIKE '%$ticket_assigned_filter%'
-    AND $ticket_status_snippet
+    AND $ticket_status_clause
     AND DATE(ticket_created_at) BETWEEN '$dtf' AND '$dtt'
     AND (CONCAT(ticket_prefix,ticket_number) LIKE '%$q%' OR client_name LIKE '%$q%' OR ticket_subject LIKE '%$q%' OR ticket_status LIKE '%$q%' OR ticket_priority LIKE '%$q%' OR user_name LIKE '%$q%' OR contact_name LIKE '%$q%' OR asset_name LIKE '%$q%' OR vendor_name LIKE '%$q%' OR ticket_vendor_ticket_number LIKE '%q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -207,15 +197,19 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']);
                         <div class="col-md-2">
                             <div class="form-group">
                                 <label>Ticket Status</label>
-                                <select class="form-control select2" name="status">
-                                    <option value="%" <?php if ($status == "%") {echo "selected";}?> >Any</option>
-                                    <option value="In-Progress" <?php if ($status == "In-Progress") {echo "selected";}?> >In-Progress</option>
-                                    <option value="Client-Replied" <?php if ($status == "Client-Replied") {echo "selected";}?> >Client-Replied</option>
-                                    <option value="Pending-Client" <?php if ($status == "Pending-Client") {echo "selected";}?> >Pending-Client</option>
-                                    <option value="Pending-Vendor" <?php if ($status == "Pending-Vendor") {echo "selected";}?> >Pending-Vendor</option>
-                                    <option value="Pending-Shipment" <?php if ($status == "Pending-Shipment") {echo "selected";}?> >Pending-Shipment</option>
-                                    <option value="Scheduled" <?php if ($status == "Scheduled") {echo "selected";}?> >Scheduled</option>
-                                    <option value="Closed" <?php if ($status == "Closed") {echo "selected";}?> >Closed</option>
+                                <select class="form-control select2" name="status[]" multiple>
+                                    <?php
+                                        foreach ($statuses as $statusValue) {
+                                            echo '<option value="' . htmlspecialchars($statusValue) . '"';
+
+                                            // Check if the current status is in the array of selected statuses
+                                            if (in_array($statusValue, $ticket_statuses)) {
+                                                echo ' selected';
+                                            }
+
+                                            echo '>' . htmlspecialchars($statusValue) . '</option>';
+                                        }
+                                    ?>
                                 </select>
                             </div>
                         </div>

From 973307524d9767faf6a7141bd1e16bc7dddcd829 Mon Sep 17 00:00:00 2001
From: Andrew Malsbury <andymalsb@gmail.com>
Date: Tue, 14 Nov 2023 17:23:13 +0000
Subject: [PATCH 3/5] Update to fix main screen

---
 tickets.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tickets.php b/tickets.php
index 3307774a..939b7a75 100644
--- a/tickets.php
+++ b/tickets.php
@@ -17,13 +17,18 @@ while ($row = mysqli_fetch_assoc($result)) {
 // Set Ticket statuses sort
 if (isset($_GET['status']) && !empty($_GET['status'])) {
     $ticket_statuses = $_GET['status'];
-    $ticket_status_clause = "ticket_status != 'Closed'";
 } else {
     $ticekt_status = "Open";
+}
+
+// Set Status Clause for SQL Query
+if (!isset($_GET['status']) || empty($_GET['status'])) {
+    $ticket_status_clause = "ticket_status != 'Closed'";
+} else {
     $ticket_status_clause = "ticket_status IN ('" . implode("','", $ticket_statuses) . "')";
 }
 
-// Make array no matter if one or none items selected.
+// Set Statuses
 if (!empty($_GET['status'])) {
     $ticket_statuses = is_array($_GET['status']) ? $_GET['status'] : array($_GET['status']);
 } else {

From 4060bea7a65afb91efb7cc4d7ce2b1a7af50b1c8 Mon Sep 17 00:00:00 2001
From: Andrew Malsbury <andymalsb@gmail.com>
Date: Tue, 14 Nov 2023 17:41:30 +0000
Subject: [PATCH 4/5] Add new ticket status and refactor ticket status filter.

---
 get_settings.php |  1 +
 tickets.php      | 29 +++++++++--------------------
 2 files changed, 10 insertions(+), 20 deletions(-)

diff --git a/get_settings.php b/get_settings.php
index b05d5268..80080ae4 100644
--- a/get_settings.php
+++ b/get_settings.php
@@ -204,6 +204,7 @@ $asset_status_array = array (
 $ticket_status_array = array (
     'Pending-Assignment',
     'Assigned',
+    'Client-Replied',
     'In-Progress',
     'Pending-Shipment',
     'Pending-Client',
diff --git a/tickets.php b/tickets.php
index 939b7a75..d869a025 100644
--- a/tickets.php
+++ b/tickets.php
@@ -6,35 +6,24 @@ $order = "DESC";
 
 require_once "inc_all.php";
 
-// Get Statuses from DB
-$statuses = array();
-$query = "SELECT DISTINCT ticket_status FROM tickets ORDER BY ticket_status";
-$result = mysqli_query($mysqli, $query);
-while ($row = mysqli_fetch_assoc($result)) {
-    $statuses[] = $row['ticket_status'];
-}
 
-// Set Ticket statuses sort
-if (isset($_GET['status']) && !empty($_GET['status'])) {
-    $ticket_statuses = $_GET['status'];
+// Set Statuses from URL
+if (!empty($_GET['status'])) {
+    $raw_statuses = is_array($_GET['status']) ? $_GET['status'] : array($_GET['status']);
+    $ticket_statuses = array_map(function($status) use ($mysqli) {
+        return mysqli_real_escape_string($mysqli, $status);
+    }, $raw_statuses);
 } else {
-    $ticekt_status = "Open";
+    $ticket_statuses = array();
 }
 
 // Set Status Clause for SQL Query
-if (!isset($_GET['status']) || empty($_GET['status'])) {
+if (empty($ticket_statuses)) {
     $ticket_status_clause = "ticket_status != 'Closed'";
 } else {
     $ticket_status_clause = "ticket_status IN ('" . implode("','", $ticket_statuses) . "')";
 }
 
-// Set Statuses
-if (!empty($_GET['status'])) {
-    $ticket_statuses = is_array($_GET['status']) ? $_GET['status'] : array($_GET['status']);
-} else {
-    $ticket_statuses = array();
-}
-
 // Ticket assignment status filter
 if (isset($_GET['assigned']) & !empty($_GET['assigned'])) {
     if ($_GET['assigned'] == 'unassigned') {
@@ -204,7 +193,7 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']);
                                 <label>Ticket Status</label>
                                 <select class="form-control select2" name="status[]" multiple>
                                     <?php
-                                        foreach ($statuses as $statusValue) {
+                                        foreach ($ticket_status_array as $statusValue) {
                                             echo '<option value="' . htmlspecialchars($statusValue) . '"';
 
                                             // Check if the current status is in the array of selected statuses

From f01d9d05307f50613eabd0ecba8652adf39e0af4 Mon Sep 17 00:00:00 2001
From: Andrew Malsbury <andymalsb@gmail.com>
Date: Tue, 14 Nov 2023 17:41:30 +0000
Subject: [PATCH 5/5] Updated to use prepared statements as

---
 get_settings.php |  1 +
 tickets.php      | 80 +++++++++++++++++++++++-------------------------
 2 files changed, 40 insertions(+), 41 deletions(-)

diff --git a/get_settings.php b/get_settings.php
index b05d5268..80080ae4 100644
--- a/get_settings.php
+++ b/get_settings.php
@@ -204,6 +204,7 @@ $asset_status_array = array (
 $ticket_status_array = array (
     'Pending-Assignment',
     'Assigned',
+    'Client-Replied',
     'In-Progress',
     'Pending-Shipment',
     'Pending-Client',
diff --git a/tickets.php b/tickets.php
index 939b7a75..44660269 100644
--- a/tickets.php
+++ b/tickets.php
@@ -6,31 +6,14 @@ $order = "DESC";
 
 require_once "inc_all.php";
 
-// Get Statuses from DB
-$statuses = array();
-$query = "SELECT DISTINCT ticket_status FROM tickets ORDER BY ticket_status";
-$result = mysqli_query($mysqli, $query);
-while ($row = mysqli_fetch_assoc($result)) {
-    $statuses[] = $row['ticket_status'];
-}
 
-// Set Ticket statuses sort
-if (isset($_GET['status']) && !empty($_GET['status'])) {
-    $ticket_statuses = $_GET['status'];
-} else {
-    $ticekt_status = "Open";
-}
-
-// Set Status Clause for SQL Query
-if (!isset($_GET['status']) || empty($_GET['status'])) {
-    $ticket_status_clause = "ticket_status != 'Closed'";
-} else {
-    $ticket_status_clause = "ticket_status IN ('" . implode("','", $ticket_statuses) . "')";
-}
-
-// Set Statuses
+// Set Statuses from URL
 if (!empty($_GET['status'])) {
-    $ticket_statuses = is_array($_GET['status']) ? $_GET['status'] : array($_GET['status']);
+    $raw_statuses = is_array($_GET['status']) ? $_GET['status'] : array($_GET['status']);
+    // Escape and quote each status
+    $ticket_statuses = array_map(function($status) use ($mysqli) {
+        return mysqli_real_escape_string($mysqli, $status);
+    }, $raw_statuses);
 } else {
     $ticket_statuses = array();
 }
@@ -51,22 +34,37 @@ if (isset($_GET['assigned']) & !empty($_GET['assigned'])) {
 //Rebuild URL
 $url_query_strings_sort = http_build_query(array_merge($_GET, array('sort' => $sort, 'order' => $order, 'status[]' => $ticket_statuses, 'assigned' => $ticket_assigned_filter)));
 
-// Main ticket query:
-$sql = mysqli_query(
-    $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM tickets
-    LEFT JOIN clients ON ticket_client_id = client_id
-    LEFT JOIN contacts ON ticket_contact_id = contact_id
-    LEFT JOIN users ON ticket_assigned_to = user_id
-    LEFT JOIN assets ON ticket_asset_id = asset_id
-    LEFT JOIN locations ON ticket_location_id = location_id
-    LEFT JOIN vendors ON ticket_vendor_id = vendor_id
-    WHERE ticket_assigned_to LIKE '%$ticket_assigned_filter%'
-    AND $ticket_status_clause
-    AND DATE(ticket_created_at) BETWEEN '$dtf' AND '$dtt'
-    AND (CONCAT(ticket_prefix,ticket_number) LIKE '%$q%' OR client_name LIKE '%$q%' OR ticket_subject LIKE '%$q%' OR ticket_status LIKE '%$q%' OR ticket_priority LIKE '%$q%' OR user_name LIKE '%$q%' OR contact_name LIKE '%$q%' OR asset_name LIKE '%$q%' OR vendor_name LIKE '%$q%' OR ticket_vendor_ticket_number LIKE '%q%')
-    ORDER BY $sort $order LIMIT $record_from, $record_to"
-);
+$sql = "SELECT SQL_CALC_FOUND_ROWS * FROM tickets
+        LEFT JOIN clients ON ticket_client_id = client_id
+        LEFT JOIN contacts ON ticket_contact_id = contact_id
+        LEFT JOIN users ON ticket_assigned_to = user_id
+        LEFT JOIN assets ON ticket_asset_id = asset_id
+        LEFT JOIN locations ON ticket_location_id = location_id
+        LEFT JOIN vendors ON ticket_vendor_id = vendor_id
+        WHERE DATE(ticket_created_at) BETWEEN ? AND ?
+        AND (CONCAT(ticket_prefix,ticket_number) LIKE ? OR client_name LIKE ? OR ticket_subject LIKE ? OR ticket_status LIKE ? OR ticket_priority LIKE ? OR user_name LIKE ? OR contact_name LIKE ? OR asset_name LIKE ? OR vendor_name LIKE ? OR ticket_vendor_ticket_number LIKE ?)";
+
+// Adding ticket status conditions dynamically
+if (!empty($ticket_statuses)) {
+    $statusPlaceholders = implode(', ', array_fill(0, count($ticket_statuses), '?'));
+    $sql .= " AND ticket_status IN ($statusPlaceholders)";
+}
+
+// Adding ORDER BY and LIMIT clauses
+$sql .= " ORDER BY " . mysqli_real_escape_string($mysqli, $sort) . " " . mysqli_real_escape_string($mysqli, $order);
+$sql .= " LIMIT ?, ?";
+
+$stmt = $mysqli->prepare($sql);
+
+// Bind Parameters
+$like_q = "%{$q}%";
+$bindTypes = 'ssssssssssss' . str_repeat('s', count($ticket_statuses)) . 'ii';
+$bindParams = array_merge([$dtf, $dtt, $like_q, $like_q, $like_q, $like_q, $like_q, $like_q, $like_q, $like_q, $like_q, $like_q], $ticket_statuses, [$record_from, $record_to]);
+call_user_func_array([$stmt, 'bind_param'], array_merge([$bindTypes], $bindParams));
+
+// Execute and retrieve results
+$stmt->execute();
+$result = $stmt->get_result();
 
 $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
@@ -204,7 +202,7 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']);
                                 <label>Ticket Status</label>
                                 <select class="form-control select2" name="status[]" multiple>
                                     <?php
-                                        foreach ($statuses as $statusValue) {
+                                        foreach ($ticket_status_array as $statusValue) {
                                             echo '<option value="' . htmlspecialchars($statusValue) . '"';
 
                                             // Check if the current status is in the array of selected statuses
@@ -279,7 +277,7 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']);
                     <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = $result->fetch_assoc()) {
                         $ticket_id = intval($row['ticket_id']);
                         $ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
                         $ticket_number = intval($row['ticket_number']);