AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add secure file handler for client ticket attachment and file view along with client and contact permission isolation, add the handler links in asset and contact

Browse Source
This commit is contained in:
johnnyq
2026-07-15 18:35:32 -04:00
parent c8f616ebee
commit 3838d052f0
9 changed files with 300 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
client/ticket.php
View File

@@ -127,13 +127,26 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
<hr>
<?php echo $ticket_details ?>
<table class="table-sm">
<?php
while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_attachments)) {
$ticket_attachment_id = intval($ticket_attachment['ticket_attachment_id']);
$name = escapeHtml($ticket_attachment['ticket_attachment_name']);
$ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='../uploads/tickets/$ticket_id/$ref_name'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
?>
<tr>
<td><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i><?= $name ?></td>
<td>
<a target='_blank' class='mr-1 ml-1' href='ticket_attachment.php?attachment_id=<?= $ticket_attachment_id; ?>&action=view'>[View]</a><a href='ticket_attachment.php?attachment_id=<?= $ticket_attachment_id; ?>'>[Download]</a>
</td>
</tr>
<?php
}
?>
</table>
</div>
</div>
@@ -319,13 +332,26 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
<div class="card-body prettyContent">
<?php echo $ticket_reply; ?>
<table class="table-sm">
<?php
while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_reply_attachments)) {
$ticket_attachment_id = intval($ticket_attachment['ticket_attachment_id']);
$name = escapeHtml($ticket_attachment['ticket_attachment_name']);
$ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='../uploads/tickets/$ticket_id/$ref_name'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
?>
<tr>
<td><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i><?= $name ?></td>
<td>
<a target='_blank' class='mr-1 ml-1' href='ticket_attachment.php?attachment_id=<?= $ticket_attachment_id; ?>&action=view'>[View]</a><a href='ticket_attachment.php?attachment_id=<?= $ticket_attachment_id; ?>'>[Download]</a>
</td>
</tr>
<?php
}
?>
</table>
</div>
</div>