diff --git a/admin/admin_ticket.php b/admin/admin_ticket.php index b180ab34..008a0c71 100644 --- a/admin/admin_ticket.php +++ b/admin/admin_ticket.php @@ -50,6 +50,9 @@ $can_unban_emails = hesk_checkPermission('can_unban_emails', 0); $can_ban_ips = hesk_checkPermission('can_ban_ips', 0); $can_unban_ips = hesk_checkPermission('can_unban_ips', 0); $can_resolve = hesk_checkPermission('can_resolve', 0); +$can_view_ass_by = hesk_checkPermission('can_view_ass_by', 0); +$can_privacy = hesk_checkPermission('can_privacy',0); +$can_export = hesk_checkPermission('can_export',0); // Get ticket ID $trackingID = hesk_cleanID() or print_form(); @@ -90,7 +93,10 @@ if (hesk_dbNumRows($res) != 1) { /* Permission to view this ticket? */ if ($ticket['owner'] && $ticket['owner'] != $_SESSION['id'] && !hesk_checkPermission('can_view_ass_others', 0)) { - hesk_error($hesklang['ycvtao']); + // Maybe this user is allowed to view tickets he/she assigned? + if (!$can_view_ass_by || $ticket['assignedby'] != $_SESSION['id']) { + hesk_error($hesklang['ycvtao']); + } } if (!$ticket['owner'] && !$can_view_unassigned) { @@ -163,7 +169,10 @@ if ($isManager) { $can_unban_emails = $can_ban_ips = $can_unban_ips = - $can_resolve = true; + $can_resolve = + $can_view_ass_by = + $can_privacy = + $can_export = true; } /* Is this user allowed to view tickets inside this category? */ @@ -1321,7 +1330,7 @@ require_once(HESK_PATH . 'inc/footer.inc.php'); function hesk_getAdminButtons($category_id) { - global $hesk_settings, $hesklang, $modsForHesk_settings, $ticket, $reply, $trackingID, $can_edit, $can_archive, $can_delete, $can_resolve, $isManager; + global $hesk_settings, $hesklang, $modsForHesk_settings, $ticket, $reply, $trackingID, $can_edit, $can_archive, $can_delete, $can_resolve, $can_privacy, $can_export, $isManager; $options = ''; @@ -1329,12 +1338,12 @@ function hesk_getAdminButtons($category_id) if ($can_edit) { $tmp = $reply ? '&reply=' . $reply['id'] : ''; $mgr = $isManager ? '&isManager=true' : ''; - $options .= ' ' . $hesklang['edit'] . ' '; + $options .= ' ' . $hesklang['edit'] . ' '; } /* Print ticket button */ - $options .= ' ' . $hesklang['printer_friendly'] . ' '; + $options .= ' ' . $hesklang['printer_friendly'] . ' '; /* Copy ticket button */ $strippedName = strip_tags($ticket['name']); @@ -1489,7 +1498,7 @@ function hesk_getAdminButtons($category_id) /* Lock ticket button */ if ($can_resolve) { $template = - '