Netsyms/Mods-for-HESK-Netsyms
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Secure ticket endpoint, add new properties to JSON

Browse Source
This commit is contained in:
Mike Koch 2016-05-01 22:18:35 -04:00
parent 26007af59f
commit cb6103319e
3 changed files with 59 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
api/admin/ticket/index.php
View File

@ -32,7 +32,7 @@ $request_method = $_SERVER['REQUEST_METHOD'];
* @apiSuccess {Integer} priority The ID of the priority the ticket is in
* @apiSuccess {String} subject The subject of the ticket
* @apiSuccess {String} message The original message of the ticket
* @apiSuccess {String} dateCreated The date and time the ticket was submitted, in `YYYY-MM-DD hh:mm:ss`
* @apiSuccess {Date} dateCreated The date and time the ticket was submitted
* @apiSuccess {Integer} articles The knowledgebase article IDs suggested when the user created the ticket
* @apiSuccess {String} ip The IP address of the submitter
* @apiSuccess {String} language The language the ticket was submitted in
@ -41,7 +41,6 @@ $request_method = $_SERVER['REQUEST_METHOD'];
* @apiSuccess {String} timeWorked The total time worked on the ticket, in `hh:mm:ss`
* @apiSuccess {Boolean} archive `true` if the ticket is tagged<br>`false` otherwise
* @apiSuccess {Boolean} locked `true` if the ticket is locked<br>`false` otherwise
* @apiSuccess {Binary[]} attachments Array of attachments, in base-64 encoded binary
* @apiSuccess {Integer[]} merged Array of merged ticket IDs
* @apiSuccess {String} legacyAuditTrail HTML markup of the entire "Audit Trail" section
* @apiSuccess {String} custom1-20 Custom fields 1-20's values.
@ -52,6 +51,8 @@ $request_method = $_SERVER['REQUEST_METHOD'];
* @apiSuccess {String} userAgent The user agent of the user who submitted the ticket
* @apiSuccess {Integer} screenResolutionWidth The width of the screen resolution of the user who submitted the ticket
* @apiSuccess {Integer} screenResolutionHeight The height of the screen resolution of the user who submitted the ticket
* @apiSuccess {Date} dueDate The ticket's due date, if there is one
* @apiSuccess {Boolean} overdueEmailSent Set to `true` if an overdue email has been sent.<br>`false` otherwise
*
* @apiSuccessExample {json} Success-Response:
* HTTP/1.1 200 OK
@ -102,7 +103,9 @@ $request_method = $_SERVER['REQUEST_METHOD'];
* "html": false,
* "userAgent": null,
* "screenResolutionWidth": null,
* "screenResolutionHeight": null
* "screenResolutionHeight": null,
* "dueDate": "2016-01-01 00:00:00",
* "overdueEmailSent": "true"
* }
*
* @apiError (noTokenProvided) 400 No `X-Auth-Token` was provided where it is required
@ -110,17 +113,18 @@ $request_method = $_SERVER['REQUEST_METHOD'];
*/
if ($request_method == 'GET') {
$token = get_header('X-Auth-Token');
$user = NULL;
try {
get_user_for_token($token, $hesk_settings);
$user = get_user_for_token($token, $hesk_settings);
} catch (AccessException $e) {
return http_response_code($e->getCode());
}
if (isset($_GET['id'])) {
$results = get_ticket_for_staff($hesk_settings, $_GET['id']);
$results = get_ticket_for_staff($hesk_settings, $user, $_GET['id']);
} else {
$results = get_ticket_for_staff($hesk_settings);
$results = get_ticket_for_staff($hesk_settings, $user);
}
if ($results == NULL) {

46
api/businesslogic/ticket_retriever.php
View File

@ -1,8 +1,12 @@
<?php
require_once(API_PATH . 'dao/ticket_dao.php');
function get_ticket_for_staff($hesk_settings, $id = NULL) {
$tickets = get_ticket_for_id($hesk_settings, $id);
function get_ticket_for_staff($hesk_settings, $user, $id = NULL) {
$tickets = get_ticket_for_id($hesk_settings, $user, $id);
if ($tickets == NULL) {
return NULL;
}
if ($id === NULL) {
$original_tickets = $tickets;
@ -10,10 +14,12 @@ function get_ticket_for_staff($hesk_settings, $id = NULL) {
foreach ($original_tickets as $ticket) {
$ticket = remove_common_properties($ticket);
$ticket = convert_to_camel_case($ticket);
$ticket = handle_dates($ticket);
$tickets[] = $ticket;
}
} else {
$tickets = remove_common_properties($tickets);
$tickets = handle_dates($tickets);
$tickets = convert_to_camel_case($tickets);
}
@ -36,27 +42,37 @@ function remove_common_properties($ticket) {
return $ticket;
}
function handle_dates($ticket) {
$ticket['dt'] = hesk_date($ticket['dt'], true);
return $ticket;
}
function convert_to_camel_case($ticket) {
if (isset($ticket['articles'])) {
$ticket['suggestedArticles'] = $ticket['articles'];
unset($ticket['articles']);
$ticket['legacyAuditTrail'] = $ticket['history'];
unset($ticket['history']);
$ticket['linkedTo'] = $ticket['parent'];
unset($ticket['parent']);
$ticket['timeWorked'] = $ticket['time_worked'];
unset($ticket['time_worked']);
$ticket['userAgent'] = $ticket['user_agent'];
unset($ticket['user_agent']);
$ticket['screenResolutionWidth'] = $ticket['screen_resolution_width'];
unset($ticket['screen_resolution_width']);
$ticket['screenResolutionHeight'] = $ticket['screen_resolution_height'];
unset($ticket['screen_resolution_height']);
}
$ticket['legacyAuditTrail'] = $ticket['history'];
unset($ticket['history']);
$ticket['linkedTo'] = $ticket['parent'];
unset($ticket['parent']);
$ticket['timeWorked'] = $ticket['time_worked'];
unset($ticket['time_worked']);
$ticket['userAgent'] = $ticket['user_agent'];
unset($ticket['user_agent']);
$ticket['screenResolutionWidth'] = $ticket['screen_resolution_width'];
unset($ticket['screen_resolution_width']);
$ticket['screenResolutionHeight'] = $ticket['screen_resolution_height'];
unset($ticket['screen_resolution_height']);
$ticket['trackingId'] = $ticket['trackid'];
unset($ticket['trackid']);
$ticket['dateCreated'] = $ticket['dt'];
unset($ticket['dt']);
$ticket['dueDate'] = $ticket['due_date'];
unset($ticket['due_date']);
$ticket['overdueEmailSent'] = $ticket['overdue_email_sent'];
return $ticket;
}
@ -83,6 +99,8 @@ function remove_staff_specific_properties($ticket) {
unset($ticket['screen_resolution_width']);
unset($ticket['screen_resolution_height']);
unset($ticket['parent']);
unset($ticket['due_date']);
unset($ticket['overdue_email_sent']);
return $ticket;
}

20
api/dao/ticket_dao.php
View File

@ -1,9 +1,22 @@
<?php
function get_ticket_for_id($hesk_settings, $id = NULL) {
$sql = "SELECT * FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` ";
function get_ticket_for_id($hesk_settings, $user, $id = NULL) {
$sql = "SELECT `tickets`.* FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` AS `tickets` ";
$sql .= "INNER JOIN `" . hesk_dbEscape($hesk_settings['db_pfix']) . "users` AS `users` ON `users`.`id` = " . intval($user['id']) . " ";
$used_where_clause = false;
if ($id != NULL) {
$sql .= "WHERE `id` = ".intval($id);
$used_where_clause = true;
$sql .= "WHERE `tickets`.`id` = " . intval($id);
}
if (!$user['isadmin']) {
$clause = $used_where_clause ? ' AND ' : ' WHERE ';
$used_where_clause = true;
$sql .= $clause . ' `category` IN (' . $user['categories'] . ')';
$sql .= " AND ((`heskprivileges` LIKE '%can_view_tickets%' AND `owner` = " . intval($user['id']) . ")";
$sql .= " OR (`heskprivileges` LIKE '%can_view_unassigned%' AND `owner` = 0)";
$sql .= " OR (`heskprivileges` LIKE '%can_view_ass_others%' AND `owner` <> " . intval($user['id']) . "))";
}
$response = hesk_dbQuery($sql);
@ -32,6 +45,7 @@ function build_results($response) {
$row['screen_resolution_width'] = convert_to_int($row['screen_resolution_width']);
$row['owner'] = convert_to_int($row['owner']);
$row['parent'] = convert_to_int($row['parent']);
$row['overdue_email_sent'] = $row['overdue_email_sent'] == true;
$results[] = $row;