From 1e894e904e756c6097a9e87bbba62408db73a660 Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Mon, 18 Apr 2016 18:38:19 -0400
Subject: [PATCH] Update print

---
 print.php | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/print.php b/print.php
index 56fa33af..adca0a00 100644
--- a/print.php
+++ b/print.php
@@ -1,7 +1,7 @@
 <?php
 /*******************************************************************************
  *  Title: Help Desk Software HESK
- *  Version: 2.6.5 from 28th August 2015
+ *  Version: 2.6.7 from 18th April 2016
  *  Author: Klemen Stirn
  *  Website: http://www.hesk.com
  ********************************************************************************
@@ -38,9 +38,19 @@ hesk_load_database_functions();
 
 hesk_session_start();
 
+// Do we have parameters in query string? If yes, store them in session and redirect
+if ( isset($_GET['track']) || isset($_GET['e']) )
+{
+    $_SESSION['p_track'] = hesk_GET('track');
+    $_SESSION['p_email'] = hesk_GET('e');
+
+    header('Location: print.php');
+    die();
+}
+
 
 /* Get the tracking ID */
-$trackingID = hesk_cleanID() or die("$hesklang[int_error]: $hesklang[no_trackID]");
+$trackingID = hesk_cleanID('p_track') or die("$hesklang[int_error]: $hesklang[no_trackID]");
 
 /* Connect to database */
 hesk_dbConnect();
@@ -52,8 +62,13 @@ if (empty($_SESSION['id'])) {
 
     // Verify email address match
     hesk_verifyEmailMatch($trackingID);
+    $my_email = hesk_getCustomerEmail(0, 'p_email');
+    hesk_verifyEmailMatch($trackingID, $my_email);
 }
 
+/* Clean ticket parameters from the session data, we don't need them anymore */
+hesk_cleanSessionVars( array('p_track', 'p_email') );
+
 /* Get ticket info */
 $res = hesk_dbQuery("SELECT `t1`.* , `ticketStatus`.`IsClosed` AS `isClosed`, `ticketStatus`.`Key` AS `statusKey`, `t2`.name AS `repliername`
 					FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` AS `t1` LEFT JOIN `" . hesk_dbEscape($hesk_settings['db_pfix']) . "users` AS `t2` ON `t1`.`replierid` = `t2`.`id`