diff --git a/api/bulk_operation.php b/api/bulk_operation.php index e94b21e..5c5b9f4 100644 --- a/api/bulk_operation.php +++ b/api/bulk_operation.php @@ -50,12 +50,14 @@ if (!$operationType || empty($ticketIds)) { exit; } -// Validate ticket IDs are integers -foreach ($ticketIds as $ticketId) { - if (!is_numeric($ticketId)) { - echo json_encode(['success' => false, 'error' => 'Invalid ticket ID format']); - exit; - } +// Validate ticket IDs are positive integers +$ticketIds = array_values(array_filter(array_map(function($id) { + $int = (int)$id; + return ($int > 0 && (string)$int === (string)$id) ? $int : null; +}, $ticketIds))); +if (empty($ticketIds)) { + echo json_encode(['success' => false, 'error' => 'No valid ticket IDs provided']); + exit; } // Use centralized database connection diff --git a/assets/js/ticket.js b/assets/js/ticket.js index 6ac03bd..efb6b27 100644 --- a/assets/js/ticket.js +++ b/assets/js/ticket.js @@ -475,10 +475,10 @@ function showDependencyError(message) { const dependentsList = document.getElementById('dependentsList'); if (dependenciesList) { - dependenciesList.innerHTML = `

${lt.escHtml(message)}

`; + dependenciesList.innerHTML = `

${lt.escHtml(message)}

`; } if (dependentsList) { - dependentsList.innerHTML = `

${lt.escHtml(message)}

`; + dependentsList.innerHTML = `

${lt.escHtml(message)}

`; } } @@ -512,7 +512,7 @@ function renderDependencies(dependencies) { ${lt.escHtml(dep.title)} ${lt.escHtml(dep.status)} - + `; }); @@ -521,7 +521,7 @@ function renderDependencies(dependencies) { } if (!hasAny) { - html = '

No dependencies configured.

'; + html = '

No dependencies configured.

'; } container.innerHTML = html; @@ -532,7 +532,7 @@ function renderDependents(dependents) { if (!container) return; if (dependents.length === 0) { - container.innerHTML = '

No tickets depend on this one.

'; + container.innerHTML = '

No tickets depend on this one.

'; return; } @@ -546,7 +546,7 @@ function renderDependents(dependents) { ${lt.escHtml(dep.title)} ${lt.escHtml(dep.status)} - (${lt.escHtml(dep.dependency_type)}) + (${lt.escHtml(dep.dependency_type)}) `; }); @@ -756,11 +756,11 @@ function loadAttachments() { if (data.success) { renderAttachments(data.attachments || []); } else { - container.innerHTML = '

Error loading attachments.

'; + container.innerHTML = '

Error loading attachments.

'; } }) .catch(error => { - container.innerHTML = '

Error loading attachments.

'; + container.innerHTML = '

Error loading attachments.

'; }); } @@ -769,7 +769,7 @@ function renderAttachments(attachments) { if (!container) return; if (attachments.length === 0) { - container.innerHTML = '

No files attached to this ticket.

'; + container.innerHTML = '

No files attached to this ticket.

'; return; } @@ -799,8 +799,8 @@ function renderAttachments(attachments) {
- - + +
`; }); @@ -1123,8 +1123,8 @@ function editComment(commentId) { Markdown
- - + +
`; @@ -1279,7 +1279,7 @@ function showReplyForm(commentId, userName) { Markdown
- +
diff --git a/models/AttachmentModel.php b/models/AttachmentModel.php index 7291719..82c4626 100644 --- a/models/AttachmentModel.php +++ b/models/AttachmentModel.php @@ -21,7 +21,7 @@ class AttachmentModel { ORDER BY a.uploaded_at DESC"; $stmt = $this->conn->prepare($sql); - $stmt->bind_param("s", $ticketId); + $stmt->bind_param("i", $ticketId); $stmt->execute(); $result = $stmt->get_result(); @@ -61,7 +61,7 @@ class AttachmentModel { VALUES (?, ?, ?, ?, ?, ?)"; $stmt = $this->conn->prepare($sql); - $stmt->bind_param("sssisi", $ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy); + $stmt->bind_param("issisi", $ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy); $result = $stmt->execute(); if ($result) { @@ -97,7 +97,7 @@ class AttachmentModel { WHERE ticket_id = ?"; $stmt = $this->conn->prepare($sql); - $stmt->bind_param("s", $ticketId); + $stmt->bind_param("i", $ticketId); $stmt->execute(); $result = $stmt->get_result(); $row = $result->fetch_assoc(); @@ -113,7 +113,7 @@ class AttachmentModel { $sql = "SELECT COUNT(*) as count FROM ticket_attachments WHERE ticket_id = ?"; $stmt = $this->conn->prepare($sql); - $stmt->bind_param("s", $ticketId); + $stmt->bind_param("i", $ticketId); $stmt->execute(); $result = $stmt->get_result(); $row = $result->fetch_assoc(); diff --git a/models/CommentModel.php b/models/CommentModel.php index efb5980..b38e0ca 100644 --- a/models/CommentModel.php +++ b/models/CommentModel.php @@ -240,7 +240,7 @@ class CommentModel { return ['success' => false, 'error' => 'Comment not found']; } - if ($comment['user_id'] != $userId && !$isAdmin) { + if ($comment['user_id'] !== (int)$userId && !$isAdmin) { return ['success' => false, 'error' => 'You do not have permission to edit this comment']; } @@ -286,7 +286,7 @@ class CommentModel { return ['success' => false, 'error' => 'Comment not found']; } - if ($comment['user_id'] != $userId && !$isAdmin) { + if ($comment['user_id'] !== (int)$userId && !$isAdmin) { return ['success' => false, 'error' => 'You do not have permission to delete this comment']; }