'', 'message' => '', 'html' => '']);
exit;
}
$host = certificateHost($input);
if (!$host) {
echo json_encode(['state' => 'bad', 'message' => "That isn't a host - something like www.example.com, or portal.example.com:8443.", 'html' => '']);
exit;
}
$response = ['host' => $host['display'], 'domain_id' => 0, 'html' => ''];
$notes = [];
if (strcasecmp($input, $host['display']) !== 0) {
$notes[] = "Saved as {$host['display']}.";
}
// Already on this client? Which of its domains is it under?
if ($check_client_id) {
$client_id = $check_client_id;
enforceClientAccess();
$host_sql = escapeSql($host['display']);
$existing = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT certificate_name FROM certificates WHERE certificate_domain = '$host_sql' AND certificate_client_id = $check_client_id AND certificate_id <> $check_certificate_id AND certificate_archived_at IS NULL LIMIT 1"));
if ($existing) {
$notes[] = 'This client already has it, as ' . $existing['certificate_name'] . '.';
}
$response['domain_id'] = certificateDomainFor($host['host'], $check_client_id);
}
$check = certificateCheck($host);
if (empty($check['reachable'])) {
$response['state'] = 'bad';
$response['message'] = trim(implode(' ', $notes) . " Nothing answered on {$host['display']} - check the host and port. If ITFlow can't reach it, paste the certificate instead.");
echo json_encode($response);
exit;
}
$state = CERTIFICATE_CHECK_STATES[$check['status']];
$response['state'] = $check['status'] === 'ok' ? 'ok' : 'warn';
$response['message'] = trim(implode(' ', $notes) . ' ' . $state['text'] . '.');
$expiry = certificateExpiry(['certificate_expire' => $check['expire'], 'certificate_issued_at' => $check['issued_at']]);
$names = $check['names'];
$response['html'] = ''
. certificateStatusPill(['certificate_check_status' => $check['status'], 'certificate_domain' => $host['display']])
. certificateExpiryPill($expiry, true) . '
'
. ''
. '- Issuer
- ' . escapeHtml($check['issuer'] ?: 'Unknown') . ($check['self_signed'] ? ' (self-signed)' : '') . '
'
. '- Valid
- ' . escapeHtml($check['issued_at']) . ' to ' . escapeHtml($check['expire']) . ' (' . $check['days'] . ' days)
'
. '- Covers
- ' . escapeHtml(implode(', ', array_slice($names, 0, 6))) . (count($names) > 6 ? ' and ' . (count($names) - 6) . ' more' : '') . '
'
. '
';
echo json_encode($response);
exit;
}
/*
* Tag picker (js/tag_picker.js) - replaces the "Assign Tags" modals.
*
* GET lists the tags one record, or a bulk selection of records, can have and
* how many of them have each. POST ticks a tag on or off for all of them -
* or, for an admin, makes a new tag and ticks it on - and sends back the
* redrawn pills for every record, so the page updates in place.
*
* Same checks the modals' post handlers made: edit rights on the module and
* access to each record's client. tagRecordsEditable() does both.
*/
if (isset($_GET['tag_picker'])) {
header('Content-Type: application/json');
$entity = (string) ($_GET['entity'] ?? '');
$config = tagEntity($entity);
$records = $config ? tagRecordsEditable($entity, (array) ($_GET['ids'] ?? [])) : false;
if ($records === false) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change the tags on these.']);
exit();
}
$ids = implode(',', array_keys($records));
$response = [
'records' => count($records),
'type' => $config['type'],
'create' => (bool) $session_is_admin,
'manage' => $session_is_admin ? "/admin/tags.php?type={$config['type']}" : '',
'tags' => []
];
// An archived tag is only offered to take it off the records that still have it
$sql = mysqli_query($mysqli,
"SELECT tag_id, tag_name, tag_description, tag_color, tag_icon, tag_archived_at,
(SELECT COUNT(*) FROM {$config['link_table']}
WHERE {$config['link_tag']} = tags.tag_id AND {$config['link_record']} IN ($ids)) AS chosen
FROM tags
WHERE tag_type = {$config['type']}
ORDER BY tag_name ASC"
);
while ($row = mysqli_fetch_assoc($sql)) {
if ($row['tag_archived_at'] && !intval($row['chosen'])) {
continue;
}
$response['tags'][] = [
'id' => intval($row['tag_id']),
'name' => $row['tag_name'],
'description' => trim((string) $row['tag_description']) . ($row['tag_archived_at'] ? (trim((string) $row['tag_description']) !== '' ? ' - ' : '') . 'Archived' : ''),
'color' => tagColor($row['tag_color']),
'icon' => tagIcon($row['tag_icon']),
'chosen' => intval($row['chosen'])
];
}
echo json_encode($response);
exit();
}
if (isset($_POST['tag_picker_set']) || isset($_POST['tag_picker_create'])) {
validateCSRFToken();
header('Content-Type: application/json');
$entity = (string) ($_POST['entity'] ?? '');
$config = tagEntity($entity);
$records = $config ? tagRecordsEditable($entity, (array) ($_POST['ids'] ?? [])) : false;
if ($records === false) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change the tags on these.']);
exit();
}
$type = $config['type'];
$link = $config['link_table'];
$link_record = $config['link_record'];
$link_tag = $config['link_tag'];
if (isset($_POST['tag_picker_create'])) {
// Making tags is an admin job everywhere else (Admin > Tags), so it is here too
$name = trim((string) ($_POST['name'] ?? ''));
if (!$session_is_admin || $name === '' || mb_strlen($name) > 200) {
http_response_code(403);
echo json_encode(['error' => 'That tag cannot be made here.']);
exit();
}
$name_sql = escapeSql($name);
// Typing the name of a tag that already exists just picks it - an archived one comes back
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT tag_id, tag_archived_at FROM tags WHERE tag_type = $type AND LOWER(tag_name) = LOWER('$name_sql') LIMIT 1"));
if ($row) {
$tag_id = intval($row['tag_id']);
if ($row['tag_archived_at']) {
tagRestore($tag_id);
logAudit("Tag", "Restore", "$session_name restored {$config['label']} tag $name_sql", 0, $tag_id);
}
} else {
$tag_id = tagCreate(['name' => $name, 'description' => '', 'type' => $type, 'color' => tagNextColor($type), 'icon' => 'tag']);
logAudit("Tag", "Create", "$session_name created {$config['label']} tag $name_sql", 0, $tag_id);
}
$on = true;
} else {
$tag_id = intval($_POST['tag_id'] ?? 0);
$on = !empty($_POST['on']);
}
// The tag has to be one of this kind of record's tags
$tag = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT tag_name, tag_archived_at FROM tags WHERE tag_id = $tag_id AND tag_type = $type"));
if (!$tag) {
http_response_code(404);
echo json_encode(['error' => 'That tag no longer exists.']);
exit();
}
// An archived tag can come off records, not go on more
if ($on && $tag['tag_archived_at']) {
http_response_code(409);
echo json_encode(['error' => 'That tag is archived.']);
exit();
}
$tag_name = escapeSql($tag['tag_name']);
$changed = 0;
foreach ($records as $record_id => $record) {
$has = mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM $link WHERE $link_record = $record_id AND $link_tag = $tag_id")) > 0;
$record_name = escapeSql($record['name']);
if ($on && !$has) {
mysqli_query($mysqli, "INSERT INTO $link SET $link_record = $record_id, $link_tag = $tag_id");
logAudit($config['log'], "Edit", "$session_name added tag $tag_name to $record_name", $record['client_id'], $record_id);
if ($entity === 'ticket') {
logTicketHistory($record_id, "$session_name added tag $tag_name");
}
$changed++;
} elseif (!$on && $has) {
mysqli_query($mysqli, "DELETE FROM $link WHERE $link_record = $record_id AND $link_tag = $tag_id");
logAudit($config['log'], "Edit", "$session_name removed tag $tag_name from $record_name", $record['client_id'], $record_id);
if ($entity === 'ticket') {
logTicketHistory($record_id, "$session_name removed tag $tag_name");
}
$changed++;
}
}
$filter = (string) ($_POST['filter'] ?? '');
$pills = [];
foreach (tagsForRecords($entity, array_keys($records)) as $record_id => $tags) {
$pills[$record_id] = tagPills($entity, $record_id, $tags, $filter);
}
echo json_encode(['tag_id' => $tag_id, 'changed' => $changed, 'pills' => $pills]);
exit();
}
/*
* Quick pickers (js/quick_pick.js) - a ticket's status, priority, assignee
* and billable, a project's manager, a recurring ticket's assignee, a
* service's importance and an asset's status, location and contact, changed in place instead of through a modal. GET lists the choices; POST makes the change through the same
* functions the post.php handlers use (functions/ticket_fields.php) and sends
* back the redrawn values.
*/
if (isset($_GET['quick_pick_options'])) {
header('Content-Type: application/json');
// A contact's location is the clients module's; everything else here is support's
enforceUserPermission(($_GET['field'] ?? '') === 'contact_location' ? 'module_client' : 'module_support', 2);
$field = (string) ($_GET['field'] ?? '');
$options = [];
if ($field === 'priority') {
$colors = ['Urgent' => 'var(--bs-emphasis-color)', 'High' => 'var(--bs-danger)', 'Medium' => 'var(--bs-warning)', 'Low' => 'var(--bs-info)'];
foreach (TICKET_PRIORITIES as $priority) {
$options[] = ['value' => $priority, 'label' => $priority, 'color' => $colors[$priority]];
}
} elseif ($field === 'status') {
foreach (ticketPickableStatuses() as $status_id => $status) {
$options[] = ['value' => (string) $status_id, 'label' => $status['ticket_status_name'], 'color' => preg_match('/^(#[0-9a-f]{3,8}|[a-z]{3,24})$/i', (string) $status['ticket_status_color']) ? $status['ticket_status_color'] : ''];
}
} elseif ($field === 'billable') {
$options[] = ['value' => '1', 'label' => 'Billable', 'icon' => 'fas fa-dollar-sign', 'description' => 'Shows under Unbilled Time once done, until invoiced'];
$options[] = ['value' => '0', 'label' => 'Not billable', 'icon' => 'fas fa-minus'];
} elseif ($field === 'assignee' || $field === 'recurring_assignee') {
$options = quickPickAgents();
} elseif ($field === 'project_manager') {
$options = quickPickAgents('No manager');
} elseif ($field === 'service_importance') {
$colors = ['High' => 'var(--bs-danger)', 'Medium' => 'var(--bs-warning)', 'Low' => 'var(--bs-secondary)'];
$descriptions = ['High' => 'Down means the client cannot work', 'Medium' => 'Down hurts, but there is a way round it', 'Low' => 'Down is an inconvenience'];
foreach (SERVICE_IMPORTANCE as $importance) {
$options[] = ['value' => $importance, 'label' => $importance, 'color' => $colors[$importance], 'description' => $descriptions[$importance]];
}
} elseif ($field === 'network_type') {
foreach (NETWORK_TYPES as $type => [$icon, $tone, $hint]) {
$options[] = ['value' => $type, 'label' => $type, 'icon' => "fas $icon", 'color' => networkToneColor($tone), 'description' => $hint];
}
} elseif (in_array($field, ASSET_QUICK_FIELDS, true) || $field === 'contact_location') {
// Locations and contacts are the client's own - functions/asset.php
$options = assetQuickOptions($field === 'contact_location' ? 'asset_location' : $field, intval($_GET['scope'] ?? 0));
if ($options === null) {
http_response_code(403);
echo json_encode(['error' => 'You cannot see that client.']);
exit();
}
} else {
http_response_code(400);
echo json_encode(['error' => 'Unknown field']);
exit();
}
echo json_encode(['options' => $options]);
exit();
}
if (isset($_POST['quick_pick_set'])) {
validateCSRFToken();
header('Content-Type: application/json');
$field = (string) ($_POST['field'] ?? '');
$value = (string) ($_POST['value'] ?? '');
$ticket_ids = array_values(array_unique(array_filter(array_map('intval', (array) ($_POST['ids'] ?? [])))));
// An asset's status, location or contact - assets of clients this agent
// can reach, with the same permission as Edit Asset (functions/asset.php)
if (in_array($field, ASSET_QUICK_FIELDS, true)) {
$asset_ids = $ticket_ids;
$allowed = lookupUserPermission('module_support') >= 2 && $asset_ids;
foreach ($allowed ? $asset_ids : [] as $id) {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT asset_client_id FROM assets WHERE asset_id = $id"));
if (!$row || !hasClientAccess($row['asset_client_id'])) {
$allowed = false;
break;
}
}
if (!$allowed) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change that on these assets.']);
exit();
}
$message = '';
$response = ['records' => []];
foreach ($asset_ids as $id) {
[$ok, $message] = assetQuickSet($id, $field, $value);
if (!$ok) {
http_response_code(422);
echo json_encode(['error' => $message]);
exit();
}
$response['records'][$id] = assetQuickRecord($id, $field);
}
$response['message'] = count($asset_ids) === 1 ? $message : 'Updated ' . count($asset_ids) . ' assets';
echo json_encode($response);
exit();
}
// A contact's location - contacts of clients this agent can reach, with
// the same permission as Edit Contact (functions/contact.php)
if ($field === 'contact_location') {
$contact_ids = $ticket_ids;
$allowed = lookupUserPermission('module_client') >= 2 && $contact_ids;
foreach ($allowed ? $contact_ids : [] as $id) {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_client_id FROM contacts WHERE contact_id = $id"));
if (!$row || !hasClientAccess($row['contact_client_id'])) {
$allowed = false;
break;
}
}
if (!$allowed) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change that on these contacts.']);
exit();
}
$message = '';
$response = ['records' => []];
foreach ($contact_ids as $id) {
[$ok, $message] = contactQuickSetLocation($id, $value);
if (!$ok) {
http_response_code(422);
echo json_encode(['error' => $message]);
exit();
}
$response['records'][$id] = contactQuickRecord($id);
}
$response['message'] = count($contact_ids) === 1 ? $message : 'Updated ' . count($contact_ids) . ' contacts';
echo json_encode($response);
exit();
}
// A service's importance - services of clients this agent can reach, not archived, like Edit Service
// A network's type - networks of clients this agent can reach, like Edit Network
if ($field === 'network_type') {
$allowed = networkCan(2) && $ticket_ids && isset(NETWORK_TYPES[$value]);
$rows = [];
foreach ($allowed ? $ticket_ids : [] as $id) {
$row = networkRow($id);
if (!$row || !hasClientAccess($row['network_client_id'])) {
$allowed = false;
break;
}
$rows[$id] = $row;
}
if (!$allowed) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change that on these networks.']);
exit();
}
$response = ['records' => []];
foreach ($rows as $id => $row) {
mysqli_query($mysqli, "UPDATE networks SET network_type = '$value' WHERE network_id = $id");
if ($row['network_type'] !== $value) {
logAudit("Network", "Edit", "$session_name changed the type of network " . escapeSql($row['network_name']) . " from " . escapeSql(networkType($row)) . " to $value", intval($row['network_client_id']), $id);
}
$html = networkTypeLabel($value);
$response['records'][$id] = ['current' => $value, 'html' => ['list' => $html, 'detail' => $html]];
}
$response['message'] = count($rows) === 1 ? 'Type set to ' . $value : 'Updated ' . count($rows) . ' networks';
echo json_encode($response);
exit();
}
if ($field === 'service_importance') {
$service_ids = $ticket_ids;
$allowed = serviceCan(2) && $service_ids && in_array($value, SERVICE_IMPORTANCE, true);
$rows = [];
foreach ($allowed ? $service_ids : [] as $id) {
$row = serviceRow($id);
if (!$row || $row['service_archived_at'] || !hasClientAccess($row['service_client_id'])) {
$allowed = false;
break;
}
$rows[$id] = $row;
}
if (!$allowed) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change that on these services.']);
exit();
}
$response = ['records' => []];
foreach ($rows as $id => $row) {
mysqli_query($mysqli, "UPDATE services SET service_importance = '$value' WHERE service_id = $id");
if ($row['service_importance'] !== $value) {
logAudit("Service", "Edit", "$session_name changed the importance of service " . escapeSql($row['service_name']) . " from {$row['service_importance']} to $value", intval($row['service_client_id']), $id);
}
$html = serviceImportancePill($value);
$response['records'][$id] = ['current' => $value, 'html' => ['list' => $html, 'detail' => $html]];
}
$response['message'] = count($rows) === 1 ? 'Importance set to ' . $value : 'Updated ' . count($rows) . ' services';
echo json_encode($response);
exit();
}
// A project's manager or a recurring ticket's assignee - open projects
// and recurring tickets of clients this agent can reach, like their edit modals
if ($field === 'project_manager' || $field === 'recurring_assignee') {
$is_project = $field === 'project_manager';
$allowed = lookupUserPermission('module_support') >= 2 && $ticket_ids;
foreach ($allowed ? $ticket_ids : [] as $id) {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, $is_project
? "SELECT project_client_id AS client_id, project_completed_at IS NULL AND project_archived_at IS NULL AS is_open FROM projects WHERE project_id = $id"
: "SELECT recurring_ticket_client_id AS client_id, 1 AS is_open FROM recurring_tickets WHERE recurring_ticket_id = $id"
));
if (!$row || !$row['is_open'] || (intval($row['client_id']) && !hasClientAccess($row['client_id']))) {
$allowed = false;
break;
}
}
if (!$allowed) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change that here.']);
exit();
}
$response = ['records' => []];
foreach ($ticket_ids as $id) {
[$ok, $message] = $is_project ? projectChangeManager($id, intval($value)) : recurringTicketChangeAssignee($id, intval($value));
if (!$ok) {
http_response_code(422);
echo json_encode(['error' => $message]);
exit();
}
$row = mysqli_fetch_assoc(mysqli_query($mysqli, $is_project
? "SELECT project_manager AS user_id, user_name, user_avatar FROM projects LEFT JOIN users ON user_id = project_manager WHERE project_id = $id"
: "SELECT recurring_ticket_assigned_to AS user_id, user_name, user_avatar FROM recurring_tickets LEFT JOIN users ON user_id = recurring_ticket_assigned_to WHERE recurring_ticket_id = $id"
));
$html = formatAssignee($row['user_id'], $row['user_name'], $row['user_avatar'], false, $is_project ? 'No manager' : 'Unassigned');
$response['records'][$id] = ['current' => (string) intval($row['user_id']), 'html' => ['list' => $html, 'detail' => $html]];
}
$response['message'] = $message;
echo json_encode($response);
exit();
}
$allowed = lookupUserPermission('module_support') >= 2
&& in_array($field, ['priority', 'assignee', 'billable', 'status'], true)
&& ($field !== 'billable' || lookupUserPermission('module_sales') >= 2)
&& $ticket_ids;
// Every ticket has to be one this agent can reach, and still open
// for priority and assignee - the same tickets the pickers are shown on
if ($allowed) {
foreach ($ticket_ids as $ticket_id) {
$row = ticketFieldsRow($ticket_id);
if (!$row || (intval($row['ticket_client_id']) && !hasClientAccess($row['ticket_client_id']))
|| ($field !== 'billable' && $row['ticket_closed_at'])) {
$allowed = false;
break;
}
}
}
if (!$allowed) {
http_response_code(403);
echo json_encode(['error' => 'You cannot change that on these tickets.']);
exit();
}
$message = '';
$response = ['records' => []];
foreach ($ticket_ids as $ticket_id) {
if ($field === 'priority') {
[$ok, $message] = ticketChangePriority($ticket_id, $value);
} elseif ($field === 'assignee') {
[$ok, $message] = ticketChangeAssignee($ticket_id, intval($value));
} elseif ($field === 'status') {
[$ok, $message] = ticketChangeStatus($ticket_id, intval($value));
} else {
[$ok, $message] = ticketChangeBillable($ticket_id, intval($value));
}
if (!$ok) {
http_response_code(422);
echo json_encode(['error' => strip_tags($message)]);
exit();
}
// Redraw what changed, in both looks, plus the status (assigning a New ticket opens it)
$row = mysqli_fetch_assoc(mysqli_query($mysqli,
"SELECT ticket_priority, ticket_assigned_to, ticket_billable, ticket_closed_at, ticket_resolved_at, ticket_status,
ticket_status_name, ticket_status_color, user_name, user_avatar
FROM tickets
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
LEFT JOIN users ON user_id = ticket_assigned_to
WHERE ticket_id = $ticket_id"
));
$is_open = empty($row['ticket_resolved_at']) && empty($row['ticket_closed_at']);
if ($field === 'priority') {
$current = $row['ticket_priority'];
$html = ['list' => ticketPriorityHtml($current, 'list'), 'detail' => ticketPriorityHtml($current, 'detail')];
} elseif ($field === 'assignee') {
$current = (string) intval($row['ticket_assigned_to']);
$assignee = formatAssignee($row['ticket_assigned_to'], $row['user_name'], $row['user_avatar'], $is_open);
$html = ['list' => $assignee, 'detail' => $assignee];
} elseif ($field === 'status') {
$current = (string) intval($row['ticket_status']);
$html = ['list' => ticketStatusHtml($row['ticket_status_name'], $row['ticket_status_color'], 'list'), 'detail' => ticketStatusHtml($row['ticket_status_name'], $row['ticket_status_color'], 'detail')];
} else {
$current = (string) intval($row['ticket_billable']);
$html = ['list' => ticketBillableHtml($current, 'list'), 'detail' => ticketBillableHtml($current, 'detail')];
}
$response['records'][$ticket_id] = [
'current' => $current,
'html' => $html,
'status_id' => intval($row['ticket_status']),
'status' => ['list' => ticketStatusHtml($row['ticket_status_name'], $row['ticket_status_color'], 'list'), 'detail' => ticketStatusHtml($row['ticket_status_name'], $row['ticket_status_color'], 'detail')]
];
}
$response['message'] = count($ticket_ids) === 1 ? strip_tags($message) : 'Updated ' . count($ticket_ids) . ' tickets';
echo json_encode($response);
exit();
}
if (isset($_POST['client_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_client', 2);
$client_id = intval($_POST['client_id']);
$notes = escapeSql($_POST['notes']);
enforceClientAccess();
// Update notes
mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id");
// Logging
logAudit("Client", "Edit", "$session_name edited client notes", $client_id);
}
/*
* Inline notes for sales documents.
*
* These replace the invoice/quote/recurring-invoice note modals, which posted
* to post.php and reloaded the page. Same permission, client-access and audit
* behaviour as those handlers had - only the delivery changed.
*/
if (isset($_POST['invoice_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']);
$note = escapeSql($_POST['note']);
$sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
enforceClientAccess();
mysqli_query($mysqli, "UPDATE invoices SET invoice_note = '$note' WHERE invoice_id = $invoice_id");
logAudit("Invoice", "Edit", "$session_name edited notes on invoice $invoice_prefix$invoice_number", $client_id, $invoice_id);
}
if (isset($_POST['quote_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$note = escapeSql($_POST['note']);
$sql = mysqli_query($mysqli, "SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
mysqli_query($mysqli, "UPDATE quotes SET quote_note = '$note' WHERE quote_id = $quote_id");
logAudit("Quote", "Edit", "$session_name edited notes on quote $quote_prefix$quote_number", $client_id, $quote_id);
}
if (isset($_POST['product_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
// A product's internal notes, from its page
$product_id = intval($_POST['product_id'] ?? 0);
$product = productRow($product_id);
if (!$product) {
http_response_code(404);
exit;
}
productSave(['notes' => (string) ($_POST['note'] ?? '')], $product_id);
logAudit("Product", "Edit", "$session_name edited notes on product " . escapeSql($product['product_name']), 0, $product_id);
}
if (isset($_POST['recurring_invoice_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$note = escapeSql($_POST['note']);
$sql = mysqli_query($mysqli, "SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);
enforceClientAccess();
mysqli_query($mysqli, "UPDATE recurring_invoices SET recurring_invoice_note = '$note' WHERE recurring_invoice_id = $recurring_invoice_id");
logAudit("Recurring Invoice", "Edit", "$session_name edited notes on recurring invoice $recurring_invoice_prefix$recurring_invoice_number", $client_id, $recurring_invoice_id);
}
if (isset($_POST['contact_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_client', 2);
$contact_id = intval($_POST['contact_id']);
$notes = escapeSql($_POST['notes']);
// Get Contact Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id
FROM contacts WHERE contact_id = $contact_id"
);
$row = mysqli_fetch_assoc($sql);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
// Update notes
mysqli_query($mysqli, "UPDATE contacts SET contact_notes = '$notes' WHERE contact_id = $contact_id");
// Logging
logAudit("Contact", "Edit", "$session_name edited contact notes for $contact_name", $client_id, $contact_id);
}
if (isset($_POST['asset_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_support', 2);
$asset_id = intval($_POST['asset_id']);
$notes = escapeSql($_POST['notes']);
// Get Asset Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id
FROM assets WHERE asset_id = $asset_id"
);
$row = mysqli_fetch_assoc($sql);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
// Update notes
mysqli_query($mysqli, "UPDATE assets SET asset_notes = '$notes' WHERE asset_id = $asset_id");
// Logging
logAudit("Asset", "Edit", "$session_name edited asset notes for $asset_name", $client_id, $asset_id);
}
/*
* Location notes (access, parking, alarm) - the location page and quick look save on blur
*/
if (isset($_POST['location_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_client', 2);
$row = locationRow($_POST['location_id'] ?? 0);
if (!$row) {
exit;
}
$client_id = intval($row['location_client_id']);
enforceClientAccess();
$location_id = intval($row['location_id']);
$notes = escapeSql($_POST['notes'] ?? '');
mysqli_query($mysqli, "UPDATE locations SET location_notes = '$notes' WHERE location_id = $location_id");
logAudit("Location", "Edit", "$session_name edited the notes on location " . escapeSql($row['location_name']), $client_id, $location_id);
}
/*
* Vendor notes (escalation path, who is authorised to call) - the vendor page saves on blur
*/
if (isset($_POST['vendor_set_notes'])) {
validateCSRFToken();
$row = vendorRow($_POST['vendor_id'] ?? 0);
if (!$row) {
exit;
}
$client_id = intval($row['vendor_client_id']);
vendorEnforce($client_id, 2);
$vendor_id = intval($row['vendor_id']);
$notes = escapeSql($_POST['notes'] ?? '');
mysqli_query($mysqli, "UPDATE vendors SET vendor_notes = '$notes' WHERE vendor_id = $vendor_id");
logAudit("Vendor", "Edit", "$session_name edited the notes on vendor " . escapeSql($row['vendor_name']), $client_id, $vendor_id);
}
/*
* License quick notes - the license page and quick look save on blur
*/
if (isset($_POST['software_set_notes'])) {
validateCSRFToken();
enforceUserPermission('module_support', 2);
$software_id = intval($_POST['software_id'] ?? 0);
$row = softwareRow($software_id);
if (!$row) {
exit;
}
$client_id = intval($row['software_client_id']);
enforceClientAccess();
$notes = escapeSql($_POST['notes'] ?? '');
mysqli_query($mysqli, "UPDATE software SET software_notes = '$notes' WHERE software_id = $software_id");
logAudit("Software", "Edit", "$session_name edited the notes on license " . escapeSql($row['software_name']), $client_id, $software_id);
}
/*
* Ticketing Collision Detection/Avoidance
* Called upon loading a ticket, and every 2 mins thereafter
* Is used in conjunction with ticket_query_views to show who is currently viewing a ticket
*/
if (isset($_GET['ticket_add_view'])) {
$ticket_id = intval($_GET['ticket_id'] ?? 0);
$view_ticket = ticketRow($ticket_id);
// Only a ticket this agent may open - the list of who is looking is no one else's business
if (lookupUserPermission('module_support') >= 1 && $view_ticket && (!intval($view_ticket['ticket_client_id']) || hasClientAccess($view_ticket['ticket_client_id']))) {
mysqli_query($mysqli, "INSERT INTO ticket_views SET view_ticket_id = $ticket_id, view_user_id = $session_user_id, view_timestamp = NOW()");
}
}
/*
* Ticketing Collision Detection/Avoidance
* Returns formatted text of the agents currently viewing a ticket
* Called upon loading a ticket, and every 2 mins thereafter
*/
if (isset($_GET['ticket_query_views'])) {
$ticket_id = intval($_GET['ticket_id'] ?? 0);
$view_ticket = ticketRow($ticket_id);
$users = [];
if (lookupUserPermission('module_support') >= 1 && $view_ticket && (!intval($view_ticket['ticket_client_id']) || hasClientAccess($view_ticket['ticket_client_id']))) {
$query = mysqli_query($mysqli, "SELECT user_name FROM ticket_views LEFT JOIN users ON view_user_id = user_id WHERE view_ticket_id = $ticket_id AND view_user_id != $session_user_id AND view_timestamp > DATE_SUB(NOW(), INTERVAL 2 MINUTE)");
while ($row = mysqli_fetch_assoc($query)) {
$users[] = $row['user_name'];
}
}
$users = array_values(array_unique($users));
$response = ['message' => ''];
if (count($users) > 1) {
$response['message'] = "" . escapeHtml(implode(", ", $users) . " are viewing this ticket.");
} elseif ($users) {
$response['message'] = "" . escapeHtml($users[0] . " is viewing this ticket.");
}
echo json_encode($response);
}
/*
* Make a shared link (agent/modals/share/share_add.php, functions/share.php)
* - a login, a document, a file, a secure note, or a request for a login.
* The link comes back once, with a QR code of it; its secret is not kept.
*/
if (isset($_POST['share_create'])) {
validateCSRFToken();
header('Content-Type: application/json');
$type = (string) ($_POST['type'] ?? '');
if (!shareCanMake($type)) {
exit(json_encode(['error' => "You don't have access to share that."]));
}
$client_id = intval($_POST['client_id'] ?? 0);
if (!$client_id || !hasClientAccess($client_id)) {
exit(json_encode(['error' => "You don't have access to that client."]));
}
$result = shareCreate([
'client_id' => $client_id,
'type' => $type,
'related_id' => intval($_POST['id'] ?? 0),
'name' => (string) ($_POST['name'] ?? ''),
'text' => (string) ($_POST['text'] ?? ''),
'recipient' => (string) ($_POST['recipient'] ?? ''),
'send' => !empty($_POST['send']),
'expires' => intval($_POST['expires'] ?? 0),
'views' => intval($_POST['views'] ?? 1),
'protect' => (string) ($_POST['protect'] ?? ''),
'passphrase' => (string) ($_POST['passphrase'] ?? ''),
'otp' => !empty($_POST['otp']),
'notify' => !empty($_POST['notify']),
'note' => (string) ($_POST['note'] ?? ''),
], $error);
if (!$result) {
exit(json_encode(['error' => $error]));
}
// "Works until Oct 17 at 9:00 AM, opens once, needs a passphrase, emailed to bob@example.com"
$summary = ['Works until ' . date('M j \a\t g:i A', strtotime($result['expire_at']))];
if ($type !== 'Request') {
$summary[] = $result['views'] ? 'opens ' . strtolower(shareViewOptions()[$result['views']]) : 'opens any number of times';
}
if ($result['protect'] === 'passphrase') {
$summary[] = 'needs the passphrase';
} elseif ($result['protect'] === 'code') {
$summary[] = 'needs a code emailed to ' . $result['recipient'];
}
if ($result['emailed']) {
$summary[] = 'emailed to ' . $result['recipient'];
}
echo json_encode([
'url' => $result['url'],
'passphrase' => $result['passphrase'],
'summary' => implode(', ', $summary),
'qr' => shareQrSvg($result['url']),
]);
exit;
}
/*
* Returns sorted list of active clients
*/
/*
* Every active client this agent can open, most recently opened first - the
* client switcher in the client side nav (js/client_switcher.js) loads it once
* and filters it as you type. Names are raw; the script renders them as text.
*/
if (isset($_GET['get_active_clients'])) {
enforceUserPermission('module_client');
$client_sql = mysqli_query(
$mysqli,
"SELECT client_id, client_name, client_abbreviation FROM clients
WHERE client_archived_at IS NULL
" . clientScopeSql('clients.client_id') . "
ORDER BY client_accessed_at DESC"
);
$response = ['clients' => []];
while ($row = mysqli_fetch_assoc($client_sql)) {
$response['clients'][] = [
'client_id' => intval($row['client_id']),
'client_name' => $row['client_name'],
'client_initials' => clientInitials($row['client_abbreviation'], $row['client_name']),
'client_tone' => clientInitialsTone($row['client_id']),
];
}
echo json_encode($response, JSON_INVALID_UTF8_SUBSTITUTE);
}
/*
* The bell panel in the top bar (js/notifications.js).
*
* notifications_feed - the latest notifications for the panel, and the unread count
* notifications_count - just the count, polled for the badge
* notifications_mark - POST: mark ids read or unread, or all=1 for everything
*
* All of it goes through functions/notifications.php, which only ever reads or
* changes the current user's own rows. Reading one is not audited; marking all
* read is, as the old "Dismiss all" was.
*/
if (isset($_GET['notifications_feed'])) {
$notifications_view = ($_GET['view'] ?? '') === 'all' ? 'all' : 'unread';
header('Content-Type: application/json');
echo json_encode([
'unread_count' => notificationUnreadCount(),
'items' => notificationsFetch($notifications_view, 20),
], JSON_INVALID_UTF8_SUBSTITUTE);
exit;
}
if (isset($_GET['notifications_count'])) {
header('Content-Type: application/json');
echo json_encode(['unread_count' => notificationUnreadCount()]);
exit;
}
if (isset($_POST['notifications_mark'])) {
validateCSRFToken();
if (!empty($_POST['all'])) {
$notifications_changed = notificationsMarkAllRead();
if ($notifications_changed) {
logAudit("Notification", "Dismiss", "$session_name marked $notifications_changed notifications as read");
}
} else {
notificationsMark($_POST['ids'] ?? [], ($_POST['state'] ?? 'read') !== 'unread');
}
header('Content-Type: application/json');
echo json_encode(['unread_count' => notificationUnreadCount()]);
exit;
}
/*
* Live results for the search palette in the top bar (js/global_search.js).
*
* Same search as the full results page - functions/search.php - so the two can
* never disagree about what this user may see. Five per group plus any app page
* whose name matches; with nothing typed yet, the recently opened clients.
* Values are raw: the palette renders them as text, never as HTML.
*/
if (isset($_GET['global_search'])) {
$global_search_query = (string) ($_GET['q'] ?? '');
$response = [
'query' => $global_search_query,
'pages' => [],
'groups' => [],
'recent' => [],
];
if (trim($global_search_query) === '') {
$response['recent'] = globalSearchRecentClients();
} else {
$response['pages'] = globalSearchPages($global_search_query);
$response['groups'] = globalSearch($global_search_query, 5);
}
header('Content-Type: application/json');
echo json_encode($response, JSON_INVALID_UTF8_SUBSTITUTE);
exit;
}
/*
* Returns the body of one canned response, for the picker on the ticket reply form.
* Fetched on demand rather than rendered into every ticket page, because the bodies are
* full HTML replies and an install can have a lot of them.
*/
if (isset($_GET['get_canned_response'])) {
enforceUserPermission('module_support');
$canned_response_id = intval($_GET['get_canned_response']);
$canned_sql = mysqli_query($mysqli, "SELECT canned_response_body FROM canned_responses
WHERE canned_response_id = $canned_response_id AND canned_response_archived_at IS NULL LIMIT 1");
$canned_row = mysqli_fetch_assoc($canned_sql);
// Purified here rather than at save time, the same way ticket replies and ticket
// template details are - what lands in the editor is what would have been rendered
require_once "../libs/htmlpurifier/HTMLPurifier.standalone.php";
$canned_purifier_config = HTMLPurifier_Config::createDefault();
$canned_purifier_config->set('Cache.DefinitionImpl', null);
$canned_purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
$canned_purifier = new HTMLPurifier($canned_purifier_config);
$response = [];
$response['body'] = $canned_row ? $canned_purifier->purify($canned_row['canned_response_body']) : '';
echo json_encode($response);
}
/*
* Returns a document's rendered content for the file previewer on agent/files.php.
*
* The previewer shows files by pointing an iframe at file.php, but a document is
* rows in a table, not bytes on disk. Rather than embedding every document's
* HTML in the page payload - a folder of long documents would be megabytes of
* JSON on a page that shows two dozen tiles - it is fetched when the document is
* actually opened.
*
* Purified here rather than at save time, the same way canned responses above
* and agent/document.php do it.
*/
if (isset($_GET['get_document_content'])) {
// Whoever can open the files list can preview its documents in the grid
enforceUserPermission('module_client');
$document_id = intval($_GET['get_document_content']);
$document_sql = mysqli_query($mysqli, "SELECT document_client_id, document_content, document_name
FROM documents WHERE document_id = $document_id LIMIT 1");
$document_row = mysqli_fetch_assoc($document_sql);
$response = [];
if ($document_row) {
// Scope the fetch to the client the document belongs to - this endpoint
// takes an id straight from the query string
$client_id = intval($document_row['document_client_id']);
enforceClientAccess();
$response['name'] = $document_row['document_name'];
$response['content'] = documentHtmlPurify($document_row['document_content']);
} else {
$response['name'] = '';
$response['content'] = '';
}
echo json_encode($response);
}
/*
* Returns ordered list of active contacts for a specified client
*/
if (isset($_GET['get_client_contacts'])) {
enforceUserPermission('module_client');
$client_id = intval($_GET['client_id']);
enforceClientAccess();
$contact_sql = mysqli_query(
$mysqli,
"SELECT contact_id, contact_name, contact_title, contact_email, contact_photo, contact_primary, contact_important, contact_technical, contact_location_id FROM contacts
LEFT JOIN clients on contact_client_id = client_id
WHERE contacts.contact_archived_at IS NULL AND contact_client_id = $client_id
" . clientScopeSql('contact_client_id') . "
ORDER BY contact_primary DESC, contact_technical DESC, contact_important DESC, contact_name"
);
// Always return the key, so a client with none gives [] rather than null
$response['contacts'] = [];
while ($row = mysqli_fetch_assoc($contact_sql)) {
// For the picker: initials on their own colour, or the photo when there is one
$row['contact_initials'] = personInitials($row['contact_name']);
$row['contact_tone'] = contactAvatarTone($row['contact_id']);
$row['contact_photo_url'] = $row['contact_photo'] ? "/uploads/clients/$client_id/" . rawurlencode($row['contact_photo']) : '';
unset($row['contact_photo']);
$response['contacts'][] = $row;
}
echo json_encode($response);
}
/*
* New Ticket - the other open tickets for the contact or asset picked, so a
* second ticket for the same problem shows up before it is raised.
*/
if (isset($_GET['ticket_also_open'])) {
enforceUserPermission('module_support', 2);
header('Content-Type: application/json');
$client_id = intval($_GET['client_id'] ?? 0);
if (!$client_id || !hasClientAccess($client_id)) {
echo json_encode(['html' => '']);
exit;
}
$also_contact_id = ticketClientOwnedId('contact', $_GET['contact_id'] ?? 0, $client_id);
$also_asset_id = ticketClientOwnedId('asset', $_GET['asset_id'] ?? 0, $client_id);
$rows = ticketAlsoOpen($also_contact_id, $also_asset_id, 0, 5);
$html = '';
if ($rows) {
$html = 'Already open for '
. ($also_contact_id && $also_asset_id ? 'this contact or asset' : ($also_contact_id ? 'this contact' : 'this asset')) . '
';
foreach ($rows as $row) {
$html .= '
' . ticketLink($row)
. ' ' . ticketStatusHtml($row['ticket_status_name'], $row['ticket_status_color'], 'detail') . '
';
}
$html .= '
Add to one of these instead, if it is the same problem.
" . escapeHtml($result['error']) . "
";
exit;
}
// Print the generated HTML template directly
echo $result['content'];
}
if (isset($_GET['ai_ticket_summary'])) {
enforceUserPermission('module_support');
header('Content-Type: text/html; charset=UTF-8');
$model = getAiModel('Tickets');
if (!$model) {
echo escapeHtml(aiModelMissingError('Tickets'));
exit;
}
// Retrieve the ticket_id from POST
$ticket_id = intval($_POST['ticket_id']);
// Query the database for ticket details
$sql = mysqli_query($mysqli, "
SELECT ticket_subject, ticket_details, ticket_source, ticket_priority, ticket_status_name, category_name, ticket_client_id
FROM tickets
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
LEFT JOIN categories ON ticket_category = category_id
WHERE ticket_id = $ticket_id
LIMIT 1
");
$row = mysqli_fetch_assoc($sql);
if (!$row) {
echo 'That ticket no longer exists.';
exit;
}
$ticket_subject = $row['ticket_subject'];
$ticket_details = strip_tags($row['ticket_details']); // strip HTML for cleaner prompt
$ticket_status = $row['ticket_status_name'];
$ticket_category = $row['category_name'];
$ticket_source = $row['ticket_source'];
$ticket_priority = $row['ticket_priority'];
$client_id = intval($row['ticket_client_id']);
// A ticket with no client is internal work any agent may read
if ($client_id) {
enforceClientAccess();
}
// Get ticket replies
$sql_replies = mysqli_query($mysqli, "
SELECT ticket_reply, ticket_reply_type, user_name
FROM ticket_replies
LEFT JOIN users ON ticket_reply_by = user_id
WHERE ticket_reply_ticket_id = $ticket_id
AND ticket_reply_archived_at IS NULL
ORDER BY ticket_reply_id ASC
");
$all_replies_text = "";
while ($reply = mysqli_fetch_assoc($sql_replies)) {
$reply_type = $reply['ticket_reply_type'];
$reply_text = strip_tags($reply['ticket_reply']);
$reply_by = $reply['user_name'];
$all_replies_text .= "\nReply Type: $reply_type Reply By: $reply_by: Reply Text: $reply_text";
}
$prompt = "
Summarize the following IT support ticket and its responses in a concise, clear, and professional manner.
The summary should include:
1. Main Issue: What was the problem reported by the user?
2. Actions Taken: What steps were taken to address the issue?
3. Resolution or Next Steps: Was the issue resolved or is it ongoing?
Please ensure:
- If there are multiple issues, summarize each separately.
- Urgency: If the ticket or replies express urgency or escalation, highlight it.
- Attachments: If mentioned in the ticket, note any relevant attachments or files.
- Avoid extra explanations or unnecessary information.
Ticket Data:
- Ticket Source: $ticket_source
- Current Ticket Status: $ticket_status
- Ticket Priority: $ticket_priority
- Ticket Category: $ticket_category
- Ticket Subject: $ticket_subject
- Ticket Details: $ticket_details
- Replies:
$all_replies_text
Formatting instructions:
- Use valid HTML tags only.
- Use for section headers (Main Issue, Actions Taken, Resolution).
- Use