From 33a2929ab6a0aa9c52265dbf778fcf4dbd3d5098 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Wed, 15 Jul 2026 13:42:19 -0400
Subject: [PATCH] Feature: Secure File Download Handler for ticket attachments
 Implemented

---
 agent/ticket.php            |  10 +--
 agent/ticket_attachment.php | 126 ++++++++++++++++++++++++++++++++++++
 2 files changed, 132 insertions(+), 4 deletions(-)
 create mode 100644 agent/ticket_attachment.php

diff --git a/agent/ticket.php b/agent/ticket.php
index 82572cfd..5837454e 100644
--- a/agent/ticket.php
+++ b/agent/ticket.php
@@ -561,9 +561,10 @@ if (isset($_GET['ticket_id'])) {
 
                         <?php
                         while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_attachments)) {
+                            $ticket_attachment_id = intval($ticket_attachment['ticket_attachment_id']);
                             $name = escapeHtml($ticket_attachment['ticket_attachment_name']);
-                            $ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
-                            echo "<hr class=''><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name <a target='_blank' class='mr-1 ml-1' href='../uploads/tickets/$ticket_id/$ref_name'>[View]</a><a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'>[Download]</a>";
+                            
+                            echo "<hr class=''><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name <a target='_blank' class='mr-1 ml-1' href='ticket_attachment.php?attachment_id=$ticket_attachment_id&action=view'>[View]</a><a href='ticket_attachment.php?attachment_id=$ticket_attachment_id'>[Download]</a>";
                         }
                         ?>
                     </div>
@@ -784,8 +785,9 @@ if (isset($_GET['ticket_id'])) {
                             <?php
                             while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_reply_attachments)) {
                                 $name = escapeHtml($ticket_attachment['ticket_attachment_name']);
-                                $ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
-                                echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='../uploads/tickets/$ticket_id/$ref_name'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
+                                $ticket_attachment_id = intval($ticket_attachment['ticket_attachment_id']);
+
+                                echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='ticket_attachment.php?attachment_id=$ticket_attachment_id'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='ticket_attachment.php?attachment_id=$ticket_attachment_id&action=view'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
                             }
                             ?>
                         </div>
diff --git a/agent/ticket_attachment.php b/agent/ticket_attachment.php
new file mode 100644
index 00000000..9ece8050
--- /dev/null
+++ b/agent/ticket_attachment.php
@@ -0,0 +1,126 @@
+<?php
+
+/*
+ * ITFlow - GET /agent/ticket_attachment.php
+ * Streams a ticket attachment for download or inline viewing
+ * without exposing the uploads directory on-disk location
+ */
+
+require_once "../config.php";
+require_once "../functions.php";
+require_once "../includes/check_login.php";
+
+// Require an attachment ID
+if (!isset($_GET['attachment_id'])) {
+    http_response_code(400);
+    exit("Attachment ID required");
+}
+
+$attachment_id = intval($_GET['attachment_id']);
+
+// Enforce module permission before revealing anything about the attachment
+enforceUserPermission('module_support');
+
+// Disposition: download by default, inline only when explicitly requested
+$disposition = "attachment";
+if (isset($_GET['action']) && $_GET['action'] == "view") {
+    $disposition = "inline";
+}
+
+// Thumbnail mode - inline image for preview use, not audit logged
+$thumb = false;
+if (isset($_GET['thumb']) && intval($_GET['thumb']) == 1) {
+    $thumb = true;
+    $disposition = "inline";
+}
+
+// Look up the attachment and its parent ticket
+$sql = mysqli_query($mysqli, "SELECT * FROM ticket_attachments
+    LEFT JOIN tickets ON ticket_attachment_ticket_id = ticket_id
+    WHERE ticket_attachment_id = $attachment_id LIMIT 1");
+
+if (mysqli_num_rows($sql) !== 1) {
+    http_response_code(404);
+    exit("Attachment not found");
+}
+
+$row = mysqli_fetch_array($sql);
+$ticket_id = intval($row['ticket_id']);
+$client_id = intval($row['ticket_client_id']);
+$attachment_name = $row['ticket_attachment_name'];
+$attachment_name_escaped = escapeSql($row['ticket_attachment_name']);
+$attachment_reference_name = $row['ticket_attachment_reference_name'];
+
+// Enforce client access against the ticket's client if the ticket is assigned to a client
+if ($client_id) {
+    enforceClientAccess();
+}
+
+// Build the on-disk path, anchored to this file's directory
+$uploads_base = realpath(__DIR__ . "/../uploads");
+$file_path = realpath(__DIR__ . "/../uploads/tickets/$ticket_id/$attachment_reference_name");
+
+// Path traversal guard - resolved path must stay inside uploads
+if ($file_path === false || $uploads_base === false || strpos($file_path, $uploads_base) !== 0) {
+    http_response_code(404);
+    exit("Attachment not found");
+}
+
+// No MIME column on ticket_attachments - detect from file content.
+// Email attachments are attacker-supplied, so never trust a declared type.
+$finfo = finfo_open(FILEINFO_MIME_TYPE);
+$attachment_mime_type = finfo_file($finfo, $file_path);
+finfo_close($finfo);
+
+// MIME types that are safe to render inline in the browser
+// Everything else (esp. HTML/SVG - stored XSS risk) falls back to download
+$inline_allowed_mime_types = array(
+    "application/pdf",
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "text/plain"
+);
+
+if ($disposition == "inline" && !in_array($attachment_mime_type, $inline_allowed_mime_types, true)) {
+    $disposition = "attachment";
+}
+
+// Strip characters that would break the Content-Disposition header
+$safe_attachment_name = str_replace(array('"', "\r", "\n"), "", basename($attachment_name));
+
+// Caching - allow the browser to reuse the file privately and revalidate cheaply
+$file_mtime = filemtime($file_path);
+$etag = '"' . md5($file_mtime . filesize($file_path) . $attachment_id) . '"';
+
+header("Cache-Control: private, max-age=3600");
+header("ETag: $etag");
+header("Last-Modified: " . gmdate("D, d M Y H:i:s", $file_mtime) . " GMT");
+
+// Conditional GET - browser already has this version, send 304 and stop
+if ((isset($_SERVER['HTTP_IF_NONE_MATCH']) && trim($_SERVER['HTTP_IF_NONE_MATCH']) == $etag)
+    || (isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) && strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']) >= $file_mtime)
+) {
+    http_response_code(304);
+    exit;
+}
+
+// Audit log - skip thumbnail loads
+if (!$thumb) {
+    logAudit("Ticket", "Download", "$session_name viewed ticket attachment $attachment_name_escaped", $client_id);
+}
+
+// Send the file
+header("Content-Type: $attachment_mime_type");
+header("Content-Disposition: $disposition; filename=\"$safe_attachment_name\"");
+header("Content-Length: " . filesize($file_path));
+header("X-Content-Type-Options: nosniff");
+
+// Clear output buffers so large files stream instead of loading into memory
+while (ob_get_level()) {
+    ob_end_clean();
+}
+
+readfile($file_path);
+exit;