From 30499123f193bbc50d240337783f48851636839b Mon Sep 17 00:00:00 2001 From: wrongecho Date: Fri, 9 Jan 2026 13:50:46 +0000 Subject: [PATCH 1/5] Bugfix: Portal not showing contact user id in session --- client/profile.php | 4 ++-- login.php | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/client/profile.php b/client/profile.php index 6209fed5..fae47819 100644 --- a/client/profile.php +++ b/client/profile.php @@ -20,9 +20,9 @@ require_once 'includes/inc_all.php';

Client Primary Contact:

Client Technical Contact:

Client Billing Contact:

- - +

Login via:

+

User ID:

diff --git a/login.php b/login.php index 50f6ea73..039faa0d 100644 --- a/login.php +++ b/login.php @@ -524,6 +524,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ "; } else { + $user_id = intval($selectedRow['contact_user_id']); $client_id = intval($selectedRow['contact_client_id']); $contact_id = intval($selectedRow['contact_id']); $user_auth_method = sanitizeInput($selectedRow['user_auth_method']); From 64525750b621c8eaa781425651a3f1db3ef210d0 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Fri, 9 Jan 2026 13:56:29 +0000 Subject: [PATCH 2/5] Fix readme demo creds --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d5c52ebe..2985a484 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@
View demo
- Username: demo@demo | Password: demo + Username: demo@demo.com | Password: demo

About From 88a29b75998c26aed27989666386eb28798a8b72 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Fri, 9 Jan 2026 16:56:11 +0000 Subject: [PATCH 3/5] Bugfix: Mail queue loop not sending invoices to all billing contacts --- agent/post/invoice.php | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/agent/post/invoice.php b/agent/post/invoice.php index 824da9c1..b0283e32 100644 --- a/agent/post/invoice.php +++ b/agent/post/invoice.php @@ -570,15 +570,13 @@ if (isset($_GET['email_invoice'])) { } // Queue Mail - $data = [ - [ + $data[] = [ 'from' => $config_invoice_from_email, 'from_name' => $config_invoice_from_name, 'recipient' => $contact_email, 'recipient_name' => $contact_name, 'subject' => $subject, 'body' => $body - ] ]; addToMailQueue($data); @@ -613,15 +611,13 @@ if (isset($_GET['email_invoice'])) { $billing_contact_name = sanitizeInput($billing_contact['contact_name']); $billing_contact_email = sanitizeInput($billing_contact['contact_email']); - $data = [ - [ + $data[] = [ 'from' => $config_invoice_from_email, 'from_name' => $config_invoice_from_name, 'recipient' => $billing_contact_email, 'recipient_name' => $billing_contact_name, 'subject' => $subject, 'body' => $body - ] ]; logAction("Invoice", "Email", "$session_name Emailed $billing_contact_email Invoice $invoice_prefix$invoice_number Email queued Email ID: $email_id", $client_id, $invoice_id); From 77e4d2b5660f79ac7961a1ce6fb0ec2bef91fe06 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Fri, 9 Jan 2026 17:14:44 +0000 Subject: [PATCH 4/5] Add task approval system --- admin/database_updates.php | 26 +- agent/ajax.php | 20 ++ .../ticket/ticket_task_approver_add.php | 140 ++++++++++ agent/modals/ticket/ticket_task_edit.php | 58 ++++- agent/post/task.php | 241 ++++++++++++++++++ agent/ticket.php | 75 +++++- client/post.php | 37 +++ client/ticket.php | 60 +++++ db.sql | 19 ++ guest/guest_approve_ticket_task.php | 114 +++++++++ guest/guest_post.php | 33 +++ includes/database_version.php | 2 +- 12 files changed, 814 insertions(+), 11 deletions(-) create mode 100644 agent/modals/ticket/ticket_task_approver_add.php create mode 100644 guest/guest_approve_ticket_task.php diff --git a/admin/database_updates.php b/admin/database_updates.php index ee595709..0a173c30 100644 --- a/admin/database_updates.php +++ b/admin/database_updates.php @@ -4134,10 +4134,30 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.8'"); } - // if (CURRENT_DATABASE_VERSION == '2.3.8') { - // // Insert queries here required to update to DB version 2.3.9 + if (CURRENT_DATABASE_VERSION == '2.3.8') { + + mysqli_query($mysqli, " + CREATE TABLE `task_approvals` ( + `approval_id` int(11) NOT NULL AUTO_INCREMENT, + `approval_scope` enum('client','internal') NOT NULL, + `approval_type` enum('any','technical','billing','specific') NOT NULL, + `approval_required_user_id` int(11) DEFAULT NULL, + `approval_status` enum('pending','approved','declined') NOT NULL, + `approval_created_by` int(11) NOT NULL, + `approval_approved_by` varchar(255) DEFAULT NULL, + `approval_url_key` varchar(200) NOT NULL, + `approval_task_id` int(11) NOT NULL, + PRIMARY KEY (`approval_id`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; + "); + + mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.9'"); + } + + // if (CURRENT_DATABASE_VERSION == '2.3.9') { + // // Insert queries here required to update to DB version 2.4.0 // // Then, update the database to the next sequential version - // mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.9'"); + // mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.4.0'"); // } } else { diff --git a/agent/ajax.php b/agent/ajax.php index 1fae441c..e153c01f 100644 --- a/agent/ajax.php +++ b/agent/ajax.php @@ -992,3 +992,23 @@ if (isset($_GET['apex_domain_check'])) { echo json_encode($response); } + +// Get internal users/techs +if (isset($_GET['get_internal_users'])) { + enforceUserPermission('module_support'); + + $sql = mysqli_query( + $mysqli, + "SELECT user_id, user_name + FROM users + WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL + ORDER BY user_name" + ); + + while ($row = mysqli_fetch_assoc($sql)) { + $response['users'][] = $row; + } + + echo json_encode($response); + exit; +} diff --git a/agent/modals/ticket/ticket_task_approver_add.php b/agent/modals/ticket/ticket_task_approver_add.php new file mode 100644 index 00000000..03064481 --- /dev/null +++ b/agent/modals/ticket/ticket_task_approver_add.php @@ -0,0 +1,140 @@ + + +
+
New approver for task
+ +
+
+ + + +
+ +
+ +
+
+ +
+ +
+
+ + +
+ +
+
+ +
+ +
+
+ + +
+ +
+
+ +
+ +
+
+ + +
+ +
+ + +
+ +
+ + + + + +
- +
@@ -49,7 +57,53 @@ ob_start();
- + + 0) { ?> +
+
+ Task Approvals + + + + + + + + + + + + + + + + + + + + +
ScopeTypeStatusAction
+ + + Delete + + + +
+ +
+ +
diff --git a/agent/post/task.php b/agent/post/task.php index 044d9a00..2950222f 100644 --- a/agent/post/task.php +++ b/agent/post/task.php @@ -155,6 +155,247 @@ if (isset($_GET['undo_complete_task'])) { } +if (isset($_POST['add_ticket_task_approver'])) { + + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_support', 2); + + $task_id = intval($_POST['task_id']); + $scope = sanitizeInput($_POST['approval_scope']); + $type = sanitizeInput($_POST['approval_type']); + $approval_url_key = randomString(32); + + $required_user_id = "NULL"; + if ($type == 'specific') { + $required_user_id = intval($_POST['approval_required_user_id']); + } + + mysqli_query($mysqli, "INSERT INTO task_approvals SET approval_scope = '$scope', approval_type = '$type', approval_required_user_id = $required_user_id, approval_status = 'pending', approval_created_by = $session_user_id, approval_url_key = '$approval_url_key', approval_task_id = $task_id"); + + $approval_id = mysqli_insert_id($mysqli); + + // Task/Ticket Info + $tt_row = mysqli_fetch_array(mysqli_query($mysqli, " + SELECT * FROM tasks + LEFT JOIN tickets ON ticket_id = task_ticket_id + LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id + WHERE task_id = $task_id LIMIT 1 + ") + ); + $task_name = sanitizeInput($tt_row['task_name']); + $ticket_id = intval($tt_row['task_ticket_id']); + $ticket_prefix = sanitizeInput($tt_row['ticket_prefix']); + $ticket_number = intval($tt_row['ticket_number']); + $ticket_subject = sanitizeInput($tt_row['ticket_subject']); + $ticket_status = sanitizeInput($tt_row['ticket_status_name']); + $ticket_url_key = sanitizeInput($tt_row['ticket_url_key']); + $ticket_contact_id = intval($tt_row['ticket_contact_id']); + $client_id = intval($tt_row['ticket_client_id']); + + // --Notifications-- + + // Sanitize Config vars from get_settings.php + $config_ticket_from_name = sanitizeInput($config_ticket_from_name); + $config_ticket_from_email = sanitizeInput($config_ticket_from_email); + $config_base_url = sanitizeInput($config_base_url); + + // Get Company Info + $crow = mysqli_fetch_array(mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1")); + $company_name = sanitizeInput($crow['company_name']); + $company_phone = sanitizeInput(formatPhoneNumber($crow['company_phone'], $crow['company_phone_country_code'])); + + // Email contents + $subject = "Ticket task approval required - [$ticket_prefix$ticket_number] - $ticket_subject"; + $body = "##- Please type your reply above this line -##

Hello,

A ticket regarding $ticket_subject has a task requiring your approval:-
Task name: $task_name
Scope/Type: $scope - $type

To approve this task, please click here.
If you require further information, please reply to this e-mail.

Ticket: $ticket_prefix$ticket_number
Subject: $ticket_subject
Status: $ticket_status
Portal: View ticket

--
$company_name - Support
$config_ticket_from_email
$company_phone"; + + if ($scope == 'internal' && $type == 'specific' && $session_user_id !== $required_user_id) { + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Ticket', notification = '$session_name needs your approval for ticket $ticket_prefix$ticket_number task $task_name', notification_action = 'ticket.php?ticket_id=$ticket_id', notification_client_id = 0, notification_user_id = $required_user_id"); + + if (!empty($config_smtp_host)) { + $agent_contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $required_user_id AND user_archived_at IS NULL")); + $name = sanitizeInput($agent_contact['user_name']); + $email = sanitizeInput($agent_contact['user_email']); + + // Only add contact to email queue if email is valid + if (filter_var($email, FILTER_VALIDATE_EMAIL)) { + $data[] = [ + 'from' => $config_ticket_from_email, + 'from_name' => $config_ticket_from_name, + 'recipient' => $email, + 'recipient_name' => $name, + 'subject' => $subject, + 'body' => $body + ]; + + addToMailQueue($data); + } + + } + } + + if (!empty($config_smtp_host) && $scope == 'client' && $type == 'any') { + + $contact_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_email FROM contacts WHERE contact_id = $ticket_contact_id LIMIT 1")); + $contact_name = sanitizeInput($contact_row['contact_name']); + $contact_email = sanitizeInput($contact_row['contact_email']); + + $data = []; + + if (filter_var($contact_email, FILTER_VALIDATE_EMAIL)) { + $data[] = [ + 'from' => $config_ticket_from_email, + 'from_name' => $config_ticket_from_name, + 'recipient' => $contact_email, + 'recipient_name' => $contact_name, + 'subject' => $subject, + 'body' => $body + ]; + addToMailQueue($data); + } + + } + + if (!empty($config_smtp_host) && $scope == 'client' && $type == 'technical') { + + $sql_technical_contacts = mysqli_query( + $mysqli, + "SELECT contact_name, contact_email FROM contacts + WHERE contact_technical = 1 + AND contact_email != '' + AND contact_client_id = $client_id" + ); + + $data = []; + + while ($technical_contact = mysqli_fetch_array($sql_technical_contacts)) { + $technical_contact_name = sanitizeInput($technical_contact['contact_name']); + $technical_contact_email = sanitizeInput($technical_contact['contact_email']); + + if (filter_var($technical_contact_email, FILTER_VALIDATE_EMAIL)) { + $data[] = [ + 'from' => $config_ticket_from_email, + 'from_name' => $config_ticket_from_name, + 'recipient' => $technical_contact_email, + 'recipient_name' => $technical_contact_name, + 'subject' => $subject, + 'body' => $body + ]; + } + + } + + addToMailQueue($data); + + } + + if (!empty($config_smtp_host) && $scope == 'client' && $type == 'billing') { + + $sql_billing_contacts = mysqli_query( + $mysqli, + "SELECT contact_name, contact_email FROM contacts + WHERE contact_billing = 1 + AND contact_email != '' + AND contact_client_id = $client_id" + ); + + $data = []; + + while ($billing_contact = mysqli_fetch_array($sql_billing_contacts)) { + $billing_contact_name = sanitizeInput($billing_contact['contact_name']); + $billing_contact_email = sanitizeInput($billing_contact['contact_email']); + + if (filter_var($billing_contact_email, FILTER_VALIDATE_EMAIL)) { + $data[] = [ + 'from' => $config_ticket_from_email, + 'from_name' => $config_ticket_from_name, + 'recipient' => $billing_contact_email, + 'recipient_name' => $billing_contact_name, + 'subject' => $subject, + 'body' => $body + ]; + } + + } + + addToMailQueue($data); + + } + + // Logging + logAction("Task", "Edit", "$session_name added task approver for $task_name", $client_id, $task_id); + + flash_alert("Added approver"); + redirect(); +} + +if (isset($_GET['approve_ticket_task'])) { + + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_support', 2); + + $task_id = intval($_GET['approve_task']); + $approval_id = intval($_GET['approval_id']); + + $approval_row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'")); + + $task_name = nullable_htmlentities($approval_row['task_name']); + $scope = nullable_htmlentities($approval_row['approval_scope']); + $type = nullable_htmlentities($approval_row['approval_type']); + $required_user = intval($approval_row['approval_required_user_id']); + $created_by = intval($approval_row['approval_created_by']); + $ticket_id = intval($approval_row['task_ticket_id']); + + if (!$approval_row) { + flash_alert("Cannot find/approve that task", 'error'); + redirect(); + exit; + } + + // Validate approver (deny) + if ($required_user > 0 && $required_user !== $session_user_id) { + flash_alert("You cannot approve that task", 'error'); + redirect(); + exit; + } + if ($required_user == 0 && $type = 'any' && $created_by == $session_user_id) { + flash_alert("You cannot approve your own task", 'error'); + redirect(); + exit; + } + + // Approve + mysqli_query($mysqli, "UPDATE task_approvals SET approval_status = 'approved', approval_approved_by = $session_user_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'"); + + // Notify + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Ticket', notification = '$session_name approved ticket task $task_name', notification_action = 'ticket.php?ticket_id=$ticket_id', notification_client_id = 0, notification_user_id = $created_by"); + // TODO: Email agent + + // Logging + logAction("Task", "Edit", "$session_name approved task $task_name (approval $approval_id)", 0, $task_id); + + flash_alert("Approved"); + redirect(); + +} + +if (isset($_GET['delete_ticket_task_approver'])) { + + validateCSRFToken($_GET['csrf_token']); + + enforceUserPermission('module_support', 3); + + $approval_id = intval($_GET['delete_ticket_task_approver']); + + mysqli_query($mysqli, "DELETE FROM task_approvals WHERE approval_id = $approval_id"); + + logAction("Task", "Delete", "$session_name deleted task approval request ($approval_id)", 0, 0); + + flash_alert("Approval request deleted", 'error'); + + redirect(); + +} + if (isset($_GET['complete_all_tasks'])) { enforceUserPermission('module_support', 2); diff --git a/agent/ticket.php b/agent/ticket.php index 266f01db..f1221ee7 100644 --- a/agent/ticket.php +++ b/agent/ticket.php @@ -961,23 +961,82 @@ if (isset($_GET['ticket_id'])) { 0; + + $approval_id = 0; + $user_can_approve = false; + $approval_rows = mysqli_query($mysqli, " + SELECT approval_id, approval_scope, approval_type, approval_required_user_id, approval_created_by + FROM task_approvals WHERE approval_task_id = $task_id AND approval_status = 'pending' + "); + + while ($approval = mysqli_fetch_array($approval_rows)) { + + $scope = nullable_htmlentities($approval['approval_scope']); + $type = nullable_htmlentities($approval['approval_type']); + $required_user = intval($approval['approval_required_user_id']); + $created_by = intval($approval['approval_created_by']); + + // Named, specific user? + if ($scope == 'internal' && $type == 'specific' && $required_user == $session_user_id) { + $user_can_approve = true; + $approval_id = intval($approval['approval_id']); + continue; + } + + // Any internal user, but the one who created the task + if ($scope == 'internal' && $type == 'any' && $created_by !== $session_user_id) { + $user_can_approve = true; + $approval_id = intval($approval['approval_id']); + continue; + } + + } + ?>
= 2) { ?> - - - + + + + + + + + + + + + + + + + + + + -
@@ -997,6 +1056,12 @@ if (isset($_GET['ticket_id'])) { data-modal-url="modals/ticket/ticket_task_edit.php?id="> Edit + + + Add Approvers + + Mark incomplete diff --git a/client/post.php b/client/post.php index 39a6a7d2..1a315915 100644 --- a/client/post.php +++ b/client/post.php @@ -185,6 +185,43 @@ if (isset($_POST['add_ticket_comment'])) { } } +if (isset($_GET['approve_ticket_task'])) { + + $task_id = intval($_GET['approve_ticket_task']); + $approval_id = intval($_GET['approval_id']); + $url_key = sanitizeInput($_GET['approval_url_key']); + + $approval_row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'")); + + $task_name = nullable_htmlentities($approval_row['task_name']); + $scope = nullable_htmlentities($approval_row['approval_scope']); + $type = nullable_htmlentities($approval_row['approval_type']); + $required_user = intval($approval_row['approval_required_user_id']); + $created_by = intval($approval_row['approval_created_by']); + $ticket_id = intval($approval_row['task_ticket_id']); + + if (!$approval_row) { + flash_alert("Cannot find/approve that task", 'warning'); + redirect(); + exit; + } + + // Approve + mysqli_query($mysqli, "UPDATE task_approvals SET approval_status = 'approved', approval_approved_by = $session_user_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'"); + + + // Notify tech + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Ticket', notification = '$session_contact_email approved ticket task $task_name', notification_action = 'ticket.php?ticket_id=$ticket_id', notification_client_id = $session_client_id, notification_user_id = $created_by"); + // TODO: Email agent + + // Logging + logAction("Task", "Edit", "Contact $session_contact_email approved task $task_name (approval $approval_id)", $session_client_id, $task_id); + + flash_alert("Task Approved"); + redirect(); + +} + if (isset($_POST['add_ticket_feedback'])) { $ticket_id = intval($_POST['ticket_id']); diff --git a/client/ticket.php b/client/ticket.php index c651694f..9051fef3 100644 --- a/client/ticket.php +++ b/client/ticket.php @@ -70,6 +70,13 @@ if (isset($_GET['id']) && intval($_GET['id'])) { ); $completed_task_count = mysqli_num_rows($sql_tasks_completed); + // Get pending task approvals + $sql_task_approvals = mysqli_query($mysqli," + SELECT task_id, task_name, approval_id, approval_scope, approval_type, approval_required_user_id, approval_status, approval_url_key + FROM tasks + LEFT JOIN task_approvals ON task_id = task_approvals.approval_task_id + WHERE task_ticket_id = $ticket_id AND task_completed_at IS NULL AND approval_scope = 'client' AND approval_status = 'pending' + "); ?>
    @@ -130,6 +137,59 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
+ + 0) { ?> +
+
+
Approvals
+ This ticket has tasks requiring approval: + + + + + +
+
+ +
diff --git a/db.sql b/db.sql index 42af2911..081bd541 100644 --- a/db.sql +++ b/db.sql @@ -2441,6 +2441,25 @@ CREATE TABLE `tasks` ( ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Table structure for table `task_approvals` +-- + +DROP TABLE IF EXISTS `task_approvals`; +CREATE TABLE IF NOT EXISTS `task_approvals` ( + `approval_id` int(11) NOT NULL AUTO_INCREMENT, + `approval_scope` enum('client','internal') NOT NULL, + `approval_type` enum('any','technical','billing','specific') NOT NULL, + `approval_required_user_id` int(11) DEFAULT NULL, + `approval_status` enum('pending','approved','declined') NOT NULL, + `approval_created_by` int(11) NOT NULL, + `approval_approved_by` varchar(255) DEFAULT NULL, + `approval_url_key` varchar(200) NOT NULL, + `approval_task_id` int(11) NOT NULL, + PRIMARY KEY (`approval_id`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; +/*!40101 SET character_set_client = @saved_cs_client */; + -- -- Table structure for table `taxes` -- diff --git a/guest/guest_approve_ticket_task.php b/guest/guest_approve_ticket_task.php new file mode 100644 index 00000000..952bcc8a --- /dev/null +++ b/guest/guest_approve_ticket_task.php @@ -0,0 +1,114 @@ +set('Cache.DefinitionImpl', null); // Disable cache by setting a non-existent directory or an invalid one +$purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); +$purifier = new HTMLPurifier($purifier_config); + +if (!isset($_GET['task_approval_id'], $_GET['url_key'])) { + echo "

Oops, something went wrong! Please raise a ticket if you believe this is an error.

"; + require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/footer.php'; + exit(); +} + +// Company info +$company_sql_row = mysqli_fetch_array(mysqli_query($mysqli, " + SELECT + company_phone, + company_phone_country_code, + company_website + FROM + companies, + settings + WHERE + companies.company_id = settings.company_id + AND companies.company_id = 1" +)); + +$company_phone_country_code = nullable_htmlentities($company_sql_row['company_phone_country_code']); +$company_phone = nullable_htmlentities(formatPhoneNumber($company_sql_row['company_phone'], $company_phone_country_code)); +$company_website = nullable_htmlentities($company_sql_row['company_website']); + +$approval_id = intval($_GET['task_approval_id']); +$url_key = sanitizeInput($_GET['url_key']); + +$task_row = mysqli_fetch_assoc(mysqli_query($mysqli, + "SELECT * FROM task_approvals + LEFT JOIN tasks ON approval_task_id = task_id + LEFT JOIN tickets on task_ticket_id = ticket_id + LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id + WHERE approval_id = $approval_id AND approval_url_key = '$url_key' + LIMIT 1" +)); + +if (!$task_row) { + // Invalid + echo "

Oops, something went wrong! Please raise a ticket if you believe this is an error.

"; + require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/footer.php'; + exit(); +} + + +$task_id = intval($task_row['task_id']); +$task_name = nullable_htmlentities($task_row['task_name']); +$approval_scope = nullable_htmlentities($task_row['approval_scope']); +$approval_type = nullable_htmlentities($task_row['approval_type']); +$approval_status = nullable_htmlentities($task_row['approval_status']); + +$ticket_prefix = nullable_htmlentities($task_row['ticket_prefix']); +$ticket_number = intval($task_row['ticket_number']); +$ticket_status = nullable_htmlentities($task_row['ticket_status_name']); +$ticket_priority = nullable_htmlentities($task_row['ticket_priority']); +$ticket_subject = nullable_htmlentities($task_row['ticket_subject']); +$ticket_details = $purifier->purify($task_row['ticket_details']); + +?> + +
+
+

+ Task Approval for Ticket +

+
+ +
+
Subject:
+

+ State: +
+ Priority: +
+

+ +
+
Task Approval
+

+ Task Name: +
+ Scope/Type: +
+ Status: +
+ + Action: Approve Task + +

+ +
+
+ +
+ +
+ $company_phone | $company_website"; ?> +
+ + Date: Mon, 12 Jan 2026 12:21:10 +0000 Subject: [PATCH 5/5] Add task approval system (tidy) --- admin/database_updates.php | 2 +- agent/ajax.php | 4 ++-- agent/post/task.php | 2 +- agent/ticket.php | 6 +++--- client/ticket.php | 2 +- guest/guest_approve_ticket_task.php | 10 +++++----- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/admin/database_updates.php b/admin/database_updates.php index 0a173c30..b753cf0d 100644 --- a/admin/database_updates.php +++ b/admin/database_updates.php @@ -4147,7 +4147,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { `approval_approved_by` varchar(255) DEFAULT NULL, `approval_url_key` varchar(200) NOT NULL, `approval_task_id` int(11) NOT NULL, - PRIMARY KEY (`approval_id`) + PRIMARY KEY (`approval_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; "); diff --git a/agent/ajax.php b/agent/ajax.php index e153c01f..ea0f7064 100644 --- a/agent/ajax.php +++ b/agent/ajax.php @@ -999,8 +999,8 @@ if (isset($_GET['get_internal_users'])) { $sql = mysqli_query( $mysqli, - "SELECT user_id, user_name - FROM users + "SELECT user_id, user_name + FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name" ); diff --git a/agent/post/task.php b/agent/post/task.php index 2950222f..f59a955d 100644 --- a/agent/post/task.php +++ b/agent/post/task.php @@ -357,7 +357,7 @@ if (isset($_GET['approve_ticket_task'])) { redirect(); exit; } - if ($required_user == 0 && $type = 'any' && $created_by == $session_user_id) { + if ($required_user == 0 && $type == 'any' && $created_by == $session_user_id) { flash_alert("You cannot approve your own task", 'error'); redirect(); exit; diff --git a/agent/ticket.php b/agent/ticket.php index f1221ee7..92ee92f5 100644 --- a/agent/ticket.php +++ b/agent/ticket.php @@ -972,9 +972,9 @@ if (isset($_GET['ticket_id'])) { $task_needs_approval = false; $task_needs_approval = mysqli_num_rows(mysqli_query( $mysqli, - "SELECT 1 FROM task_approvals - WHERE approval_task_id = $task_id - AND approval_status IN ('pending','declined') + "SELECT 1 FROM task_approvals + WHERE approval_task_id = $task_id + AND approval_status IN ('pending','declined') LIMIT 1" )) > 0; diff --git a/client/ticket.php b/client/ticket.php index 9051fef3..6e85fe6e 100644 --- a/client/ticket.php +++ b/client/ticket.php @@ -75,7 +75,7 @@ if (isset($_GET['id']) && intval($_GET['id'])) { SELECT task_id, task_name, approval_id, approval_scope, approval_type, approval_required_user_id, approval_status, approval_url_key FROM tasks LEFT JOIN task_approvals ON task_id = task_approvals.approval_task_id - WHERE task_ticket_id = $ticket_id AND task_completed_at IS NULL AND approval_scope = 'client' AND approval_status = 'pending' + WHERE task_ticket_id = $ticket_id AND task_completed_at IS NULL AND approval_scope = 'client' AND approval_status = 'pending' "); ?> diff --git a/guest/guest_approve_ticket_task.php b/guest/guest_approve_ticket_task.php index 952bcc8a..f5ded027 100644 --- a/guest/guest_approve_ticket_task.php +++ b/guest/guest_approve_ticket_task.php @@ -3,7 +3,7 @@ require_once "includes/inc_all_guest.php"; //Initialize the HTML Purifier to prevent XSS -require "../plugins/htmlpurifier/HTMLPurifier.standalone.php"; +require_once "../plugins/htmlpurifier/HTMLPurifier.standalone.php"; $purifier_config = HTMLPurifier_Config::createDefault(); $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting a non-existent directory or an invalid one @@ -18,14 +18,14 @@ if (!isset($_GET['task_approval_id'], $_GET['url_key'])) { // Company info $company_sql_row = mysqli_fetch_array(mysqli_query($mysqli, " - SELECT + SELECT company_phone, company_phone_country_code, - company_website - FROM + company_website + FROM companies, settings - WHERE + WHERE companies.company_id = settings.company_id AND companies.company_id = 1" ));