From bd7f67aa5b4d3b9c24e021605af80fa812dce44c Mon Sep 17 00:00:00 2001 From: johnnyq Date: Fri, 28 Aug 2026 17:33:04 -0400 Subject: [PATCH] Enhancement: Files: Document and Files are easily distinguashable now with the option to choose all docs or just files. Thumbnails view now shows all files, Previews now available for documents, pdfs, txts etc, List view and Thumbnail view now retain in search param when navigating folders --- agent/ajax.php | 48 +++ agent/file.php | 9 +- agent/files.php | 573 +++++++++++++++++++++++++++----- agent/modals/file/file_view.php | 59 +++- agent/ticket_attachment.php | 9 +- client/file.php | 9 +- client/functions.php | 31 -- client/ticket_attachment.php | 9 +- functions/files.php | 170 ++++++++++ 9 files changed, 758 insertions(+), 159 deletions(-) diff --git a/agent/ajax.php b/agent/ajax.php index 799c08f9c..558a8daa9 100644 --- a/agent/ajax.php +++ b/agent/ajax.php @@ -413,6 +413,54 @@ if (isset($_GET['get_canned_response'])) { } +/* + * Returns a document's rendered content for the file previewer on agent/files.php. + * + * The previewer shows files by pointing an iframe at file.php, but a document is + * rows in a table, not bytes on disk. Rather than embedding every document's + * HTML in the page payload - a folder of long documents would be megabytes of + * JSON on a page that shows two dozen tiles - it is fetched when the document is + * actually opened. + * + * Purified here rather than at save time, the same way canned responses above + * and agent/document.php do it. + */ +if (isset($_GET['get_document_content'])) { + enforceUserPermission('module_support'); + + $document_id = intval($_GET['get_document_content']); + + $document_sql = mysqli_query($mysqli, "SELECT document_client_id, document_content, document_name + FROM documents WHERE document_id = $document_id LIMIT 1"); + + $document_row = mysqli_fetch_assoc($document_sql); + + $response = []; + + if ($document_row) { + // Scope the fetch to the client the document belongs to - this endpoint + // takes an id straight from the query string + $client_id = intval($document_row['document_client_id']); + enforceClientAccess(); + + require_once "../libs/htmlpurifier/HTMLPurifier.standalone.php"; + + $document_purifier_config = HTMLPurifier_Config::createDefault(); + $document_purifier_config->set('Cache.DefinitionImpl', null); + $document_purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); + $document_purifier = new HTMLPurifier($document_purifier_config); + + $response['name'] = $document_row['document_name']; + $response['content'] = $document_purifier->purify($document_row['document_content']); + } else { + $response['name'] = ''; + $response['content'] = ''; + } + + echo json_encode($response); + +} + /* * Returns ordered list of active contacts for a specified client */ diff --git a/agent/file.php b/agent/file.php index 455a64f7f..edc7fc452 100644 --- a/agent/file.php +++ b/agent/file.php @@ -54,14 +54,7 @@ enforceClientAccess(); // MIME types that are safe to render inline in the browser // Everything else (esp. HTML/SVG - stored XSS risk) falls back to download -$inline_allowed_mime_types = array( - "application/pdf", - "image/png", - "image/jpeg", - "image/gif", - "image/webp", - "text/plain" -); +$inline_allowed_mime_types = getInlineViewableMimeTypes(); if ($disposition == "inline" && !in_array($file_mime_type, $inline_allowed_mime_types, true)) { $disposition = "attachment"; diff --git a/agent/files.php b/agent/files.php index 7265c98d5..8d7340cba 100644 --- a/agent/files.php +++ b/agent/files.php @@ -16,7 +16,40 @@ if (!empty($_GET['folder_id'])) { // Folder ID (used in forms/etc) $get_folder_id = $folder_id; -// View Mode -- 0 List, 1 Thumbnail (thumbnail = files only) +/* + * Type filter -- '' all, 'file' uploads only, 'document' created documents only. + * + * Whitelisted rather than trusted: it decides which of the two queries below run + * at all, so an unexpected value should mean "everything", not an empty page. + * + * Like the view mode, it rides along on every folder link - a filter that + * silently clears itself the moment you open a folder is worse than no filter. + */ +$type_filter = $_GET['type'] ?? ''; +if (!in_array($type_filter, ['file', 'document'], true)) { + $type_filter = ''; +} + +/* + * Links for the filter buttons. Built from a copy with 'type' removed so the + * new value does not land next to the old one, and with 'page' removed because + * switching filter while on page 4 of the files would otherwise open page 4 of + * a shorter list and show nothing. + */ +$type_get_copy = $_GET; +unset($type_get_copy['type'], $type_get_copy['page'], $type_get_copy['sort'], $type_get_copy['order']); +$url_query_strings_type = http_build_query($type_get_copy); +if ($url_query_strings_type !== '') { + $url_query_strings_type .= '&'; +} + +/* + * View Mode -- 0 List, 1 Grid + * + * Carried on every folder link below. Without it, opening a folder dropped the + * parameter and the page fell back to list view, so picking grid only lasted + * until the next click. + */ if (!empty($_GET['view'])) { $view = intval($_GET['view']); } else { @@ -80,13 +113,13 @@ function isAncestorFolder($folder_id, $current_folder_id, $client_id) { } function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root = false) { - global $mysqli, $get_folder_id, $session_user_role, $archive_query, $archived, $num_root_items, $folders_expanded; + global $mysqli, $get_folder_id, $session_user_role, $archive_query, $archived, $num_root_items, $folders_expanded, $view, $type_filter; // Always render root (only once) if ($parent_folder_id == 0 && $indent == 0) { echo '
  • '; echo ''; + echo ' href="?client_id=' . $client_id . '&folder_id=0&view=' . $view . '&type=' . $type_filter . '&archived=' . $archived . '&folders_expanded=' . $folders_expanded . '">'; echo '/'; if ($num_root_items > 0) { @@ -153,7 +186,7 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root echo ''; + echo ' href="?client_id=' . $client_id . '&folder_id=' . $folder_id . '&view=' . $view . '&type=' . $type_filter . '&archived=' . $archived . '&folders_expanded=' . $folders_expanded . '">'; if ($on_active_path) { echo ''; @@ -213,46 +246,93 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root // --------------------------------------------- // DATA LOAD -// view=1 (thumbs) uses original files-only query +// view=1 (grid) - every file in the folder, thumbnail or file-type icon // view=0 (list) loads ALL files+documents, merges, sorts in PHP // --------------------------------------------- $items = []; $num_rows = [0]; +// Both views decide previewability from this, so it is set before the branch - +// it used to be assigned inside the grid arm only, which left the list arm +// passing null to in_array() +$inline_viewable_mime_types = getInlineViewableMimeTypes(); + if ($view == 1) { - // Thumbnail view - only image files, similar to original behavior - $query_images = "AND (file_ext LIKE 'JPG' OR file_ext LIKE 'jpg' OR file_ext LIKE 'JPEG' OR file_ext LIKE 'jpeg' OR file_ext LIKE 'png' OR file_ext LIKE 'PNG' OR file_ext LIKE 'webp' OR file_ext LIKE 'WEBP')"; + /* + * GRID VIEW: files AND documents, same as the list view beside it. + * + * This used to be a single files-only query with SQL_CALC_FOUND_ROWS and a + * LIMIT. Two sources cannot be paginated by one LIMIT, so it now mirrors + * exactly what the list view does: fetch both unpaginated, merge, sort by + * name, and slice in PHP. That also fixes the grid quietly omitting every + * created document - they were only ever visible in list view. + */ + $safe_q = mysqli_real_escape_string($mysqli, $q); if ($get_folder_id == 0 && isset($_GET["q"])) { - $sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM files - LEFT JOIN users ON file_created_by = user_id - WHERE file_client_id = $client_id - AND file_$archive_query - AND (file_name LIKE '%$q%' OR file_ext LIKE '%$q%' OR file_description LIKE '%$q%') - $query_images - ORDER BY file_name ASC - LIMIT $record_from, $record_to" - ); + $file_folder_snippet = ""; // search across all folders + $doc_folder_snippet = ""; } else { - $sql = mysqli_query( + $file_folder_snippet = "AND file_folder_id = $folder_id"; + $doc_folder_snippet = "AND document_folder_id = $folder_id"; + } + + $file_search_snippet = ""; + $doc_search_snippet = ""; + if (!empty($q)) { + $file_search_snippet = "AND (file_name LIKE '%$safe_q%' OR file_ext LIKE '%$safe_q%' OR file_description LIKE '%$safe_q%')"; + $doc_search_snippet = "AND (MATCH(document_content_raw) AGAINST ('$safe_q') OR document_name LIKE '%$safe_q%')"; + } + + // Skipped outright when the type filter excludes them + $sql_grid_files = false; + if ($type_filter !== 'document') { + $sql_grid_files = mysqli_query( $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM files + "SELECT files.*, users.user_name + FROM files LEFT JOIN users ON file_created_by = user_id WHERE file_client_id = $client_id - AND file_folder_id = $folder_id AND file_$archive_query - AND (file_name LIKE '%$q%' OR file_ext LIKE '%$q%' OR file_description LIKE '%$q%') - $query_images - ORDER BY file_name ASC - LIMIT $record_from, $record_to" + $file_folder_snippet + $file_search_snippet" ); } - $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + $sql_grid_documents = false; + if ($type_filter !== 'file') { + $sql_grid_documents = mysqli_query( + $mysqli, + "SELECT documents.*, users.user_name + FROM documents + LEFT JOIN users ON document_created_by = user_id + WHERE document_client_id = $client_id + AND document_$archive_query + $doc_folder_snippet + $doc_search_snippet" + ); + } + + while ($sql_grid_files && ($row = mysqli_fetch_assoc($sql_grid_files))) { + $row['grid_kind'] = 'file'; + $items[] = $row; + } + + while ($sql_grid_documents && ($row = mysqli_fetch_assoc($sql_grid_documents))) { + $row['grid_kind'] = 'document'; + $items[] = $row; + } + + usort($items, function ($a, $b) { + $a_name = strtolower($a['grid_kind'] === 'file' ? $a['file_name'] : $a['document_name']); + $b_name = strtolower($b['grid_kind'] === 'file' ? $b['file_name'] : $b['document_name']); + return strcmp($a_name, $b_name); + }); + + $num_rows = [count($items)]; + $items = array_slice($items, $record_from, $record_to); } else { @@ -280,8 +360,11 @@ if ($view == 1) { $doc_search_snippet = "AND (MATCH(document_content_raw) AGAINST ('$safe_q') OR document_name LIKE '%$safe_q%')"; } - // Files query (NO limit - we'll paginate in PHP) - $sql_files = mysqli_query( + // Files query (NO limit - we'll paginate in PHP). Skipped outright when the + // type filter excludes files, rather than fetching rows to throw away. + $sql_files = false; + if ($type_filter !== 'document') { + $sql_files = mysqli_query( $mysqli, "SELECT files.*, users.user_name FROM files @@ -290,10 +373,13 @@ if ($view == 1) { AND file_$archive_query $file_folder_snippet $file_search_snippet" - ); + ); + } // Documents query (NO limit - paginate in PHP) - $sql_documents = mysqli_query( + $sql_documents = false; + if ($type_filter !== 'file') { + $sql_documents = mysqli_query( $mysqli, "SELECT documents.*, users.user_name FROM documents @@ -302,10 +388,11 @@ if ($view == 1) { AND document_$archive_query $doc_folder_snippet $doc_search_snippet" - ); + ); + } // Normalize FILES into $items - while ($row = mysqli_fetch_assoc($sql_files)) { + while ($sql_files && ($row = mysqli_fetch_assoc($sql_files))) { $file_id = intval($row['file_id']); $file_name = escapeHtml($row['file_name']); $file_description = escapeHtml($row['file_description']); @@ -349,6 +436,7 @@ if ($view == 1) { 'description' => $file_description, 'reference_name' => $file_reference_name, 'icon' => $file_icon, + 'ext' => $file_ext, 'mime' => $file_mime_type, 'size' => $file_size, 'created_at' => $file_created_at, @@ -358,7 +446,7 @@ if ($view == 1) { } // Normalize DOCUMENTS into $items - while ($row = mysqli_fetch_assoc($sql_documents)) { + while ($sql_documents && ($row = mysqli_fetch_assoc($sql_documents))) { $document_id = intval($row['document_id']); $document_name = escapeHtml($row['document_name']); $document_description = escapeHtml($row['document_description']); @@ -501,6 +589,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    + @@ -515,6 +604,11 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    +
    + " title="Files and documents">All + " title="Uploaded files only">Files + " title="Created documents only">Docs +
    " title="List View"> " title="Grid View"> @@ -566,7 +660,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    + $file_id, + 'name' => basename($file_name), + 'kind' => ($file_mime_type === 'application/pdf') ? 'pdf' + : (($file_mime_type === 'text/plain' || $file_mime_type === 'application/json') ? 'text' : 'image'), + 'icon' => $file_icon, + 'ext' => strtoupper($file_ext), + 'size' => $file_size_human, + 'excerpt' => '', + 'preview' => "file.php?file_id=$file_id&action=view", + 'download' => "file.php?file_id=$file_id", + 'action' => 'Download' + ]; + } + ?> - + = 0) { ?> + + + +
    @@ -864,9 +1169,12 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    +
    - +

    @@ -877,7 +1185,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])

    - Document + Document - @@ -956,6 +1264,16 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num']) + + +
    @@ -971,8 +1289,74 @@ function openModal(index) { } function updateModalContent() { - document.getElementById('modalTitle').innerText = files[currentIndex].name; - document.getElementById('modalImage').src = files[currentIndex].preview; + var file = files[currentIndex]; + var image = document.getElementById('modalImage'); + var frame = document.getElementById('modalFrame'); + var fallback = document.getElementById('modalFallback'); + var text = document.getElementById('modalText'); + var docPanel = document.getElementById('modalDocument'); + + document.getElementById('modalTitle').innerText = file.name; + document.getElementById('modalMeta').innerText = file.size ? (file.ext + ' \u00b7 ' + file.size) : file.ext; + var action = document.getElementById('modalDownload'); + action.href = file.download; + action.innerHTML = '' + file.action; + document.getElementById('modalPosition').innerText = (currentIndex + 1) + ' of ' + files.length; + + // Blank the previous file's source before switching panels, or a heavy PDF + // keeps rendering behind the next image until the browser gets round to it + image.classList.add('d-none'); + image.removeAttribute('src'); + frame.classList.add('d-none'); + frame.removeAttribute('src'); + fallback.classList.add('d-none'); + text.classList.add('d-none'); + docPanel.classList.add('d-none'); + docPanel.innerHTML = ''; + + if (file.kind === 'document') { + + /* + * Fetched rather than carried in the page payload - see the endpoint's + * note in ajax.php. The index is captured so a fast click through to the + * next file does not get overwritten by a response that arrives late. + */ + var requestedIndex = currentIndex; + docPanel.innerHTML = '

    Loading...

    '; + docPanel.classList.remove('d-none'); + + fetch(file.preview, { headers: { 'X-Requested-With': 'XMLHttpRequest' } }) + .then(function (r) { return r.json(); }) + .then(function (data) { + if (requestedIndex !== currentIndex) { + return; + } + // The endpoint returns HTMLPurifier output, which is what + // document.php renders too + docPanel.innerHTML = data.content || '

    This document is empty.

    '; + }) + .catch(function () { + if (requestedIndex === currentIndex) { + docPanel.innerHTML = '

    Could not load this document.

    '; + } + }); + + } else if (file.kind === 'image') { + image.src = file.preview; + image.alt = file.name; + image.classList.remove('d-none'); + } else if (file.kind === 'pdf' || file.kind === 'text') { + frame.src = file.preview; + frame.classList.remove('d-none'); + } else { + document.getElementById('modalFallbackIcon').className = 'fas fa-' + file.icon + ' fa-4x text-secondary'; + fallback.classList.remove('d-none'); + } + + // One file in the folder means nothing to page through + var single = files.length < 2; + document.getElementById('modalPrev').classList.toggle('d-none', single); + document.getElementById('modalNext').classList.toggle('d-none', single); } function nextFile() { @@ -984,6 +1368,19 @@ function prevFile() { currentIndex = (currentIndex - 1 + files.length) % files.length; updateModalContent(); } + +// Arrow keys page the gallery while the preview is open +document.addEventListener('keydown', function (e) { + var modal = document.getElementById('viewFileModal'); + if (!modal || !modal.classList.contains('show') || files.length < 2) { + return; + } + if (e.key === 'ArrowRight') { + nextFile(); + } else if (e.key === 'ArrowLeft') { + prevFile(); + } +}); diff --git a/agent/modals/file/file_view.php b/agent/modals/file/file_view.php index 9b0579a53..3e8bec780 100644 --- a/agent/modals/file/file_view.php +++ b/agent/modals/file/file_view.php @@ -1,23 +1,66 @@ +