AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-05 15:17:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reworked getFieldById to remove escaping and and reworked everything that uses the function to also escape, was causing double escaping in many places this standardizes the function

Browse Source
This commit is contained in:
johnnyq
2026-08-01 15:33:48 -04:00
parent 75028ba09a
commit 23a09f54fc
8 changed files with 56 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
agent/ajax.php
View File

@@ -545,7 +545,7 @@ if (isset($_POST['update_kanban_ticket'])) {
mysqli_query($mysqli, "UPDATE tickets SET ticket_order = $kanban, ticket_status = $status, ticket_resolved_at = NULL WHERE ticket_id = $ticket_id");
resetTicketResolutionSla($ticket_id);
syncTicketSlaClock($ticket_id);
$new_status_name = getTicketStatusName($status, 'sql');
$new_status_name = escapeSql(getTicketStatusName($status));
logTicketHistory($ticket_id, "$session_name reopened the ticket to $new_status_name from the kanban");
triggerCustomAction('ticket_update', $ticket_id);
} elseif ($status === $statuses['Resolved']) {
@@ -638,7 +638,7 @@ if (isset($_POST['update_kanban_ticket'])) {
// If the ticket was moved from any status to another status
mysqli_query($mysqli, "UPDATE tickets SET ticket_order = $kanban, ticket_status = $status WHERE ticket_id = $ticket_id");
syncTicketSlaClock($ticket_id);
$new_status_name = getTicketStatusName($status, 'sql');
$new_status_name = escapeSql(getTicketStatusName($status));
logTicketHistory($ticket_id, "$session_name set the status to $new_status_name from the kanban");
triggerCustomAction('ticket_update', $ticket_id);
}

10
agent/post/ticket.php
View File

@@ -127,7 +127,7 @@ if (isset($_POST['add_ticket'])) {
$ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']);
$ticket_priority = escapeSql($row['ticket_priority']);
$ticket_status = escapeSql($row['ticket_status']);
$ticket_status_name = getTicketStatusName($row['ticket_status'], 'sql');
$ticket_status_name = escapeSql(getTicketStatusName($row['ticket_status']));
$client_id = intval($row['ticket_client_id']);
$ticket_created_by = intval($row['ticket_created_by']);
$ticket_assigned_to = intval($row['ticket_assigned_to']);
@@ -263,7 +263,7 @@ if (isset($_POST['edit_ticket'])) {
if ($original_assigned_to !== $assigned_to) {
if ($assigned_to) {
$new_agent_name = escapeSql(getFieldById('users', $assigned_to, 'user_name', 'raw'));
$new_agent_name = escapeSql(getFieldById('users', $assigned_to, 'user_name'));
logTicketHistory($ticket_id, "$session_name assigned the ticket to $new_agent_name");
} else {
logTicketHistory($ticket_id, "$session_name unassigned the ticket");
@@ -1548,7 +1548,7 @@ if (isset($_POST['bulk_ticket_reply'])) {
mysqli_query($mysqli, "UPDATE tickets SET ticket_status = '$ticket_status' WHERE ticket_id = $ticket_id");
syncTicketSlaClock($ticket_id);
$new_status_name = getTicketStatusName($ticket_status, 'sql');
$new_status_name = escapeSql(getTicketStatusName($ticket_status));
logTicketHistory($ticket_id, "$session_name set the status to $new_status_name");
logAudit("Ticket", "Reply", "$session_name replied to ticket $ticket_prefix$ticket_number - $ticket_subject and was a $ticket_reply_type reply", $client_id, $ticket_id);
@@ -1861,7 +1861,7 @@ if (isset($_POST['add_ticket_reply'])) {
}
// Add Signature to the end of the ticket reply if not Internal and if there is reply
if ($ticket_reply !== '' && $ticket_reply_type !== 'Internal' && $send_email == 1) {
$ticket_reply .= getFieldById('user_settings',$session_user_id,'user_config_signature', 'raw');
$ticket_reply .= getFieldById('user_settings',$session_user_id,'user_config_signature');
}
$ticket_reply = mysqli_escape_string($mysqli, $ticket_reply); // SQL Escape Ticket Reply
@@ -2032,7 +2032,7 @@ if (isset($_POST['add_ticket_reply'])) {
flashAlert("Stored on the ticket but too large to email: <strong>" . implode(', ', $skipped_names) . "</strong>", 'error');
}
$new_status_name = getTicketStatusName($ticket_status, 'sql');
$new_status_name = escapeSql(getTicketStatusName($ticket_status));
logTicketHistory($ticket_id, "$session_name set the status to $new_status_name");
logAudit("Ticket", "Reply", "$session_name replied to ticket $ticket_prefix$ticket_number - $ticket_subject and was a $ticket_reply_type reply", $client_id, $ticket_id);

6
agent/tickets.php
View File

@@ -170,7 +170,7 @@ $category_filter = '';
if (!empty($_GET['category'])) {
$category_filter = intval($_GET['category']);
$category_query = "AND ticket_category = $category_filter";
$active_filters[] = array('label' => 'Category', 'value' => getFieldById('categories', $category_filter, 'category_name', 'html'), 'drop' => 'category');
$active_filters[] = array('label' => 'Category', 'value' => escapeHtml(getFieldById('categories', $category_filter, 'category_name')), 'drop' => 'category');
}
// Priority Filter
@@ -219,7 +219,7 @@ if (!empty($_GET['assigned'])) {
} else {
$ticket_assigned_filter_id = intval($_GET['assigned']);
$ticket_assigned_query = "AND ticket_assigned_to = $ticket_assigned_filter_id";
$assigned_name = $ticket_assigned_filter_id === intval($session_user_id) ? 'Me' : getFieldById('users', $ticket_assigned_filter_id, 'user_name', 'html');
$assigned_name = $ticket_assigned_filter_id === intval($session_user_id) ? 'Me' : escapeHtml(getFieldById('users', $ticket_assigned_filter_id, 'user_name'));
$active_filters[] = array('label' => 'Assigned', 'value' => $assigned_name, 'drop' => 'assigned');
}
}
@@ -230,7 +230,7 @@ $ticket_project_filter_id = '';
if (!empty($_GET['project'])) {
$ticket_project_filter_id = intval($_GET['project']);
$ticket_project_snippet = "AND ticket_project_id = $ticket_project_filter_id";
$active_filters[] = array('label' => 'Project', 'value' => getFieldById('projects', $ticket_project_filter_id, 'project_name', 'html'), 'drop' => 'project');
$active_filters[] = array('label' => 'Project', 'value' => escapeHtml(getFieldById('projects', $ticket_project_filter_id, 'project_name')), 'drop' => 'project');
}
// Date range - filter_header.php resolves the canned ranges into $dtf / $dtt

2
agent/user/user_details.php
View File

@@ -58,7 +58,7 @@ require_once "includes/inc_all_user.php";
<div class="form-group">
<label>Signature</label>
<textarea class="form-control tinymceTicket" name="signature" rows="4" placeholder="Create a signature automatically appended to tickets, emails etc"><?= getFieldById('user_settings',$session_user_id,'user_config_signature','html') ?>
<textarea class="form-control tinymceTicket" name="signature" rows="4" placeholder="Create a signature automatically appended to tickets, emails etc"><?= escapeHtml(getFieldById('user_settings',$session_user_id,'user_config_signature')) ?>
</textarea>
</div>