Fix type safety and TDS class naming issues
- bulk_operation.php: replace is_numeric() with strict int cast+equality to reject scientific notation - AttachmentModel.php: fix bind_param type strings (s→i for integer ticket IDs) - CommentModel.php: use strict !== comparison with (int) cast for user_id ownership checks - ticket.js: replace all non-TDS class names (text-amber→lt-text-amber, btn→lt-btn variants, etc.) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -21,7 +21,7 @@ class AttachmentModel {
|
||||
ORDER BY a.uploaded_at DESC";
|
||||
|
||||
$stmt = $this->conn->prepare($sql);
|
||||
$stmt->bind_param("s", $ticketId);
|
||||
$stmt->bind_param("i", $ticketId);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
|
||||
@@ -61,7 +61,7 @@ class AttachmentModel {
|
||||
VALUES (?, ?, ?, ?, ?, ?)";
|
||||
|
||||
$stmt = $this->conn->prepare($sql);
|
||||
$stmt->bind_param("sssisi", $ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy);
|
||||
$stmt->bind_param("issisi", $ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy);
|
||||
$result = $stmt->execute();
|
||||
|
||||
if ($result) {
|
||||
@@ -97,7 +97,7 @@ class AttachmentModel {
|
||||
WHERE ticket_id = ?";
|
||||
|
||||
$stmt = $this->conn->prepare($sql);
|
||||
$stmt->bind_param("s", $ticketId);
|
||||
$stmt->bind_param("i", $ticketId);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
$row = $result->fetch_assoc();
|
||||
@@ -113,7 +113,7 @@ class AttachmentModel {
|
||||
$sql = "SELECT COUNT(*) as count FROM ticket_attachments WHERE ticket_id = ?";
|
||||
|
||||
$stmt = $this->conn->prepare($sql);
|
||||
$stmt->bind_param("s", $ticketId);
|
||||
$stmt->bind_param("i", $ticketId);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
$row = $result->fetch_assoc();
|
||||
|
||||
@@ -240,7 +240,7 @@ class CommentModel {
|
||||
return ['success' => false, 'error' => 'Comment not found'];
|
||||
}
|
||||
|
||||
if ($comment['user_id'] != $userId && !$isAdmin) {
|
||||
if ($comment['user_id'] !== (int)$userId && !$isAdmin) {
|
||||
return ['success' => false, 'error' => 'You do not have permission to edit this comment'];
|
||||
}
|
||||
|
||||
@@ -286,7 +286,7 @@ class CommentModel {
|
||||
return ['success' => false, 'error' => 'Comment not found'];
|
||||
}
|
||||
|
||||
if ($comment['user_id'] != $userId && !$isAdmin) {
|
||||
if ($comment['user_id'] !== (int)$userId && !$isAdmin) {
|
||||
return ['success' => false, 'error' => 'You do not have permission to delete this comment'];
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user