AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Feature: Secure File Download Handler for ticket attachments Implemented

Browse Source
This commit is contained in:
johnnyq
2026-07-15 13:42:19 -04:00
parent df3a24eab7
commit 33a2929ab6
2 changed files with 132 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
agent/ticket.php
View File

@@ -561,9 +561,10 @@ if (isset($_GET['ticket_id'])) {
<?php
while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_attachments)) {
$ticket_attachment_id = intval($ticket_attachment['ticket_attachment_id']);
$name = escapeHtml($ticket_attachment['ticket_attachment_name']);
$ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
echo "<hr class=''><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name <a target='_blank' class='mr-1 ml-1' href='../uploads/tickets/$ticket_id/$ref_name'>[View]</a><a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'>[Download]</a>";
echo "<hr class=''><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name <a target='_blank' class='mr-1 ml-1' href='ticket_attachment.php?attachment_id=$ticket_attachment_id&action=view'>[View]</a><a href='ticket_attachment.php?attachment_id=$ticket_attachment_id'>[Download]</a>";
}
?>
</div>
@@ -784,8 +785,9 @@ if (isset($_GET['ticket_id'])) {
<?php
while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_reply_attachments)) {
$name = escapeHtml($ticket_attachment['ticket_attachment_name']);
$ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='../uploads/tickets/$ticket_id/$ref_name'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
$ticket_attachment_id = intval($ticket_attachment['ticket_attachment_id']);
echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='ticket_attachment.php?attachment_id=$ticket_attachment_id'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='ticket_attachment.php?attachment_id=$ticket_attachment_id&action=view'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
}
?>
</div>