From 76cad075664d7c84732fd64671fddf46ffe9d8dd Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sat, 19 Mar 2022 19:10:36 +0000
Subject: [PATCH] Client portal initial - add functionality to post ticket
 replies

---
 portal/login.php       |  9 +++++----
 portal/portal_post.php | 42 ++++++++++++++++++++++++++++++++++++++++
 portal/ticket.php      | 44 ++++++++++++++++++++++++++++++++++--------
 ticket.php             | 25 ++++++++++++++++--------
 4 files changed, 100 insertions(+), 20 deletions(-)
 create mode 100644 portal/portal_post.php

diff --git a/portal/login.php b/portal/login.php
index 95209987..388112a5 100644
--- a/portal/login.php
+++ b/portal/login.php
@@ -79,11 +79,12 @@ if($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login'])){
     <h2><?php echo $config_app_name; ?> - Client Portal Login</h2>
 
     <form action="login.php" method="post">
-      <input class="form-control" type="text" name="email" placeholder="someone@example.com">
+      <div class="form-group">
+        <input class="form-control" type="text" name="email" placeholder="someone@example.com">
+        <input class="form-control" type="password" name="password" placeholder="Pa$$word">
+      </div>
 
-      <input class="form-control" type="password" name="password" placeholder="Pa$$word">
-
-      <button class="btn-primary" type="submit" name="login">Login</button>
+      <button class="btn btn-primary" type="submit" name="login">Login</button>
     </form>
     <?php
       if(!empty($_SESSION['login_message'])){
diff --git a/portal/portal_post.php b/portal/portal_post.php
new file mode 100644
index 00000000..95a390ad
--- /dev/null
+++ b/portal/portal_post.php
@@ -0,0 +1,42 @@
+<?php
+/*
+ * Client Portal
+ * Process GET/POST requests
+ */
+
+include('../config.php');
+include('../functions.php');
+include('check_login.php');
+
+$session_company_id = $_SESSION['company_id'];
+$session_client_id = $_SESSION['client_id'];
+$session_contact_id = $_SESSION['contact_id'];
+
+if(!isset($_SESSION)){
+  // HTTP Only cookies
+  ini_set("session.cookie_httponly", True);
+  if($config_https_only){
+    // Tell client to only send cookie(s) over HTTPS
+    ini_set("session.cookie_secure", True);
+  }
+  session_start();
+}
+
+if(isset($_POST['add_ticket_comment'])){
+  $requested_ticket_id = intval($_POST['ticket_id']);
+  $comment = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['comment'])));
+
+  // Verify the client has access to the provided ticket ID
+  $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$requested_ticket_id' AND ticket_status != 'Closed' AND ticket_client_id = '$session_client_id'");
+  $row = mysqli_fetch_array($sql);
+  $ticket_id = $row['ticket_id'];
+
+  // Add client comment
+  mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$comment', ticket_reply_type = 'Client', ticket_reply_created_at = NOW(), ticket_reply_by = '$session_contact_id', ticket_reply_ticket_id = '$ticket_id', company_id = '$session_company_id'");
+
+  // Update Ticket Last Response Field & set ticket to open as client has replied
+  mysqli_query($mysqli,"UPDATE tickets SET ticket_status = 'Open', ticket_updated_at = NOW() WHERE ticket_id = $ticket_id AND company_id = $session_company_id");
+
+  header("Location: " . $_SERVER["HTTP_REFERER"]);
+
+}
\ No newline at end of file
diff --git a/portal/ticket.php b/portal/ticket.php
index f5a60f2f..04641ca0 100644
--- a/portal/ticket.php
+++ b/portal/ticket.php
@@ -48,26 +48,54 @@ if(isset($_GET['id']) && intval($_GET['id'])) {
   <div class="container">
 
     <h2>Ticket Details - <?php echo $ticket['ticket_subject'] ?></h2>
-    <p>State: <?php echo $ticket['ticket_status'] ?></p>
-    <p>Priority: <?php echo $ticket['ticket_priority'] ?></p>
+    <p>
+      Reference: <?php echo $ticket['ticket_prefix'], $ticket['ticket_number'] ?>
+      <br>
+      State: <?php echo $ticket['ticket_status'] ?>
+      <br>
+      Priority: <?php echo $ticket['ticket_priority'] ?>
+    </p>
 
     <hr>
 
+    <?php if($ticket['ticket_status'] !== "Closed") { ?>
+
+      <div class="form-group">
+        <form action="portal_post.php" method="post">
+          <div class="form-group">
+            <textarea class="form-control" name="comment" placeholder="Add comments.."></textarea>
+          </div>
+          <input type="hidden" name="ticket_id" value="<?php echo $ticket['ticket_id'] ?>">
+          <button type="submit" class="btn btn-primary" name="add_ticket_comment">Add comment</button>
+        </form>
+      </div>
+      <hr>
+
+    <?php } ?>
+
     <?php
-    $sql = mysqli_query($mysqli,"SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type = 'Public' ORDER BY ticket_reply_id DESC");
+    $sql = mysqli_query($mysqli,"SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type != 'Internal' ORDER BY ticket_reply_id DESC");
 
     while($row = mysqli_fetch_array($sql)){;
       $ticket_reply_id = $row['ticket_reply_id'];
       $ticket_reply = $row['ticket_reply'];
       $ticket_reply_created_at = $row['ticket_reply_created_at'];
       $ticket_reply_by = $row['ticket_reply_by'];
-      $ticket_reply_by_display = $row['user_name'];
-      $user_id = $row['user_id'];
-      $user_avatar = $row['user_avatar'];
-      $user_initials = initials($row['user_name']);
+      $ticket_reply_type = $row['ticket_reply_type'];
+
+      if($ticket_reply_type == "Client"){
+        $ticket_reply_by_display = $row['contact_name'];
+        $user_initials = initials($row['contact_name']);
+      }
+      else{
+        $ticket_reply_by_display = $row['user_name'];
+        $user_id = $row['user_id'];
+        $user_avatar = $row['user_avatar'];
+        $user_initials = initials($row['user_name']);
+      }
       ?>
 
-      <div class="card card-outline card-info mb-3">
+      <div class="card card-outline <?php if($ticket_reply_type == 'Client') {echo "card-warning"; } else{ echo "card-info"; } ?> mb-3">
         <div class="card-header">
           <h3 class="card-title">
             <div class="media">
diff --git a/ticket.php b/ticket.php
index ab2fc301..d3eadb3f 100644
--- a/ticket.php
+++ b/ticket.php
@@ -266,7 +266,7 @@ if(isset($_GET['ticket_id'])){
     <?php } ?>
 
     <?php
-    $sql = mysqli_query($mysqli,"SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL ORDER BY ticket_reply_id DESC");
+    $sql = mysqli_query($mysqli,"SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL ORDER BY ticket_reply_id DESC");
 
       while($row = mysqli_fetch_array($sql)){;
         $ticket_reply_id = $row['ticket_reply_id'];
@@ -275,14 +275,21 @@ if(isset($_GET['ticket_id'])){
         $ticket_reply_created_at = $row['ticket_reply_created_at'];
         $ticket_reply_updated_at = $row['ticket_reply_updated_at'];
         $ticket_reply_by = $row['ticket_reply_by'];
-        $ticket_reply_by_display = $row['user_name'];
-        $user_id = $row['user_id'];
-        $user_avatar = $row['user_avatar'];
-        $user_initials = initials($row['user_name']);
-        $ticket_reply_time_worked = date_create($row['ticket_reply_time_worked']);
+
+        if($ticket_reply_type == "Client"){
+          $ticket_reply_by_display = $row['contact_name'];
+          $user_initials = initials($row['contact_name']);
+        }
+        else{
+          $ticket_reply_by_display = $row['user_name'];
+          $user_id = $row['user_id'];
+          $user_avatar = $row['user_avatar'];
+          $user_initials = initials($row['user_name']);
+          $ticket_reply_time_worked = date_create($row['ticket_reply_time_worked']);
+        }
     ?>
 
-    <div class="card card-outline <?php if($ticket_reply_type == 'Internal'){ echo "card-dark"; }else{ echo "card-info"; } ?> mb-3">
+    <div class="card card-outline <?php if($ticket_reply_type == 'Internal'){ echo "card-dark"; } elseif($ticket_reply_type == 'Client') {echo "card-warning"; } else{ echo "card-info"; } ?> mb-3">
       <div class="card-header">
         <h3 class="card-title">
           <div class="media">
@@ -302,7 +309,9 @@ if(isset($_GET['ticket_id'])){
               <br>
               <small class="text-muted"><?php echo $ticket_reply_created_at; ?> <?php if(!empty($ticket_reply_updated_at)){ echo "modified: $ticket_reply_updated_at"; } ?></small>
               <br>
-              <small class="text-muted">Time worked: <?php echo date_format($ticket_reply_time_worked, 'H:i:s'); ?></small>
+              <?php if($ticket_reply_type !== "Client") { ?>
+                <small class="text-muted">Time worked: <?php echo date_format($ticket_reply_time_worked, 'H:i:s'); ?></small>
+              <?php } ?>
             </div>
           </div>
         </h3>