Merge development into main: 15-issue triage + fix batch

Fixes 15 tracked issues from the tinker_tickets tracker, all verified against a local MariaDB instance and/or jsdom/manual test harnesses where applicable: #75, #84, #102, #29, #53, #90, #60, #79, #61, #31, #96, #41, #89, #59, #52, #42, #66, #40, #106, #54, #92, #97, #51, #91, #101, #63, #55, #65, #107. Also fixes a real, previously-undetected outage in .env.example: parse_ini_file() could not parse the file as shipped (fragile '#' comment handling plus an unquoted LDAP_BIND_DN value), meaning the documented setup step of `cp .env.example .env` would have broken every fresh deployment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X
2026-09-08 15:39:36 -04:00
parent 6e0863449f 3cca956ee7
commit cef1689c05
28 changed files with 699 additions and 433 deletions
@@ -1,60 +1,79 @@
-# Tinker Tickets Environment Configuration
-# Copy this file to .env and fill in your values
-#
-# NOTE: This file is parsed with parse_ini_file(). Any value containing special
-# characters (#, ;, =, quotes, spaces, etc.) MUST be wrapped in double quotes,
-# e.g. DB_PASS="p@ss;word#1". The application now fails loudly (dies with a clear
-# error) if the .env file cannot be parsed, so an unquoted special character will
-# take the whole app down rather than silently using a wrong value.
+; Tinker Tickets Environment Configuration
+; Copy this file to .env and fill in your values
+;
+; NOTE: This file is parsed with PHP's parse_ini_file. Any value containing
+; special characters -- #, ;, =, quotes, spaces, etc. -- MUST be wrapped in
+; double quotes, e.g. DB_PASS="p@ss;word#1". The application now fails loudly
+; -- dies with a clear error -- if the .env file cannot be parsed, so an
+; unquoted special character will take the whole app down rather than
+; silently using a wrong value.
+;
+; Comments in this file use ";" rather than "#": PHP's ini parser treats "#"
+; comments as fragile -- punctuation like parentheses or quotes inside a "#"
+; comment can produce a syntax error even though the line is meant to be
+; inert, silently breaking every value below it. ";" comments don't have this
+; problem, so keep using ";" for any comment added to this file.

-# Database Configuration
+; Database Configuration
 DB_HOST=10.10.10.50
 DB_USER=tinkertickets
 DB_PASS=your_password_here
 DB_NAME=ticketing_system

-# Matrix Webhook (optional - for notifications via matrix-hookshot)
-# Set to your hookshot generic webhook URL, e.g.:
-#   https://matrix.lotusguild.org/webhook/<uuid>
+; Matrix Webhook (optional - for notifications via matrix-hookshot)
+; Set to your hookshot generic webhook URL, e.g.:
+;   https://matrix.lotusguild.org/webhook/uuid-goes-here
 MATRIX_WEBHOOK_URL=

-# Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
-# e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
+; Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
+; e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
 MATRIX_NOTIFY_USERS=

-# Application Domain (required for Matrix webhook ticket links)
-# Set this to your public domain (e.g., t.lotusguild.org)
+; Matrix homeserver domain (used to build Matrix user IDs from LLDAP usernames)
+MATRIX_DOMAIN=
+
+; Synapse internal URL and admin token (used to resolve usernames -> Matrix IDs
+; for watcher DMs)
+SYNAPSE_ADMIN_URL=
+SYNAPSE_ADMIN_TOKEN=
+
+; Optional: send a Matrix notification on comments and/or assignments (0/1)
+MATRIX_NOTIFY_COMMENTS=0
+MATRIX_NOTIFY_ASSIGNMENTS=0
+
+; Application Domain (required for Matrix webhook ticket links)
+; Set this to your public domain, e.g. t.lotusguild.org
 APP_DOMAIN=

-# Allowed Hosts for HTTP_HOST validation (comma-separated)
-# Include all domains that can access this application
+; Allowed Hosts for HTTP_HOST validation (comma-separated)
+; Include all domains that can access this application
 ALLOWED_HOSTS=localhost,127.0.0.1

-# Trusted reverse proxy IP(s), comma-separated (e.g. the Authelia/nginx proxy).
-# Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
-# headers (Remote-User / Remote-Groups) and forwarded client IPs are only
-# trusted when REMOTE_ADDR is in this list.
-#
-# Leaving this EMPTY disables reverse-proxy verification entirely: the app then
-# trusts Remote-User / Remote-Groups headers from ANY source. That is unsafe if
-# the PHP backend is reachable directly (bypassing the proxy), because a client
-# can then spoof those headers and log in as an admin. Only leave it empty when
-# network topology guarantees PHP is reachable solely via the trusted proxy.
-#
-# Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
-# Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
+; Trusted reverse proxy IPs, comma-separated -- e.g. the Authelia/nginx proxy.
+; Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
+; headers (Remote-User / Remote-Groups) and forwarded client IPs are only
+; trusted when REMOTE_ADDR is in this list.
+;
+; Leaving this EMPTY disables reverse-proxy verification entirely: the app then
+; trusts Remote-User / Remote-Groups headers from ANY source. That is unsafe if
+; the PHP backend is reachable directly (bypassing the proxy), because a client
+; can then spoof those headers and log in as an admin. Only leave it empty when
+; network topology guarantees PHP is reachable solely via the trusted proxy.
+;
+; Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
+; Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
 TRUSTED_PROXIES=

-# Timezone (default: America/New_York)
+; Timezone (default: America/New_York)
 TIMEZONE=America/New_York

-# LDAP / lldap (for user avatar lookups)
+; LDAP / lldap (for user avatar lookups)
 LDAP_ENABLED=true
 LDAP_HOST=10.10.10.39
 LDAP_PORT=3890
-LDAP_BIND_DN=uid=tinker-tickets,ou=people,dc=example,dc=com
+LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com"
 LDAP_BIND_PW=
-LDAP_BASE_DN=dc=example,dc=com
-LDAP_USER_BASE=ou=people,dc=example,dc=com
-# How long to cache avatar images locally (seconds, default 3600)
+LDAP_BASE_DN="dc=example,dc=com"
+LDAP_USER_BASE="ou=people,dc=example,dc=com"
+; How long to cache avatar images locally (seconds, default 3600)
 AVATAR_CACHE_TTL=3600
@@ -362,7 +362,6 @@ tinker_tickets/
 │   ├── Database.php                      # Centralized mysqli connection
 │   ├── ErrorHandler.php                  # Global error/exception handler
 │   ├── NotificationHelper.php            # Matrix hookshot webhook events
-│   ├── OutputHelper.php                  # Safe HTML output helpers
 │   ├── ResponseHelper.php                # JSON API response helpers
 │   ├── SynapseHelper.php                 # Resolves usernames → Matrix IDs via Synapse admin API
 │   └── UrlHelper.php                     # Canonical ticket URLs using APP_DOMAIN
@@ -556,7 +555,7 @@ Key conventions and gotchas for working with this codebase:
 21. **Confirm dialogs**: Never use browser `confirm()`. Use `showConfirmModal(title, message, type, onConfirm)` (defined in `utils.js`, available on all pages). Types: `'warning'` | `'error'` | `'info'`.
 22. **`utils.js` on all pages**: `utils.js` is loaded by all views (including admin). It provides `escapeHtml()`, `getTicketIdFromUrl()`, and `showConfirmModal()`.
 23. **No `toast.js`**: `toast.js` is deprecated and no longer loaded by any view. Use `lt.toast.success/error/warning/info()` directly from `base.js`.
-24. **Stats cache**: `StatsModel` caches stats for 60 s. Any path that modifies ticket state must call `(new StatsModel($conn))->invalidateCache()` after the change. Callers: `TicketController::create` (manual create), `create_ticket_api.php` (external API create/escalate/reopen), `cron/create_recurring_tickets.php`, `bulk_operation`, `assign_ticket`, `update_ticket`, and `clone_ticket`.
+24. **Stats cache**: `StatsModel` caches stats for 60 s. Any path that modifies ticket state must call `(new StatsModel($conn))->invalidateCache()` after the change. Callers: `TicketController::create` (manual create), `create_ticket_api.php` (external API create/escalate/reopen), `cron/create_recurring_tickets.php`, `bulk_operation`, `assign_ticket`, `update_ticket`, `clone_ticket`, and `ticket_status_api.php` (Bearer API status-change endpoint).
 25. **External API (`create_ticket_api.php`)**: Uses `ApiKeyAuth` (Bearer token), not session auth. Served directly by the web server from the document root — not through the index.php router. Includes deduplication logic (SHA-256 hash, no time window) that updates/escalates an existing open duplicate or reopens a closed one rather than creating a new ticket.

 ## File Reference
@@ -8,8 +8,10 @@
 require_once __DIR__ . '/bootstrap.php';

 try {
-    // Get all users for mentions/assignment
-    $result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username");
+    // Get all users for mentions/assignment. Capped as defense-in-depth against
+    // a single call scraping an unbounded user list — every caller only needs
+    // this for typeahead/dropdown filtering, never a literal full roster.
+    $result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username LIMIT 500");

    if (!$result) {
        throw new Exception("Failed to query users");
@@ -129,6 +129,39 @@ if (version_compare(PHP_VERSION, $requirements['min_php_version'], '>=')) {
    $healthy = false;
 }

+// Check 7: memory_limit / max_execution_time sanity (warnings, not fatal — a
+// low default doesn't fail requests until something large actually runs, so
+// surface it here rather than waiting for a mysterious failure under load).
+$memLimitIni = ini_get('memory_limit');
+$memLimitUnit = strtolower(substr(trim($memLimitIni), -1));
+$memLimitBytes = $memLimitIni === '-1'
+    ? -1
+    : (int)$memLimitIni * match ($memLimitUnit) {
+        'g' => 1024 * 1024 * 1024,
+        'm' => 1024 * 1024,
+        'k' => 1024,
+        default => 1,
+    };
+$minMemBytes = $requirements['min_memory_limit_mb'] * 1024 * 1024;
+if ($memLimitBytes === -1 || $memLimitBytes >= $minMemBytes) {
+    $checks['memory_limit'] = ['status' => 'ok', 'message' => $memLimitIni];
+} else {
+    $checks['memory_limit'] = [
+        'status' => 'warning',
+        'message' => sprintf('%s is below the recommended minimum %dM', $memLimitIni, $requirements['min_memory_limit_mb'])
+    ];
+}
+
+$maxExecTime = (int)ini_get('max_execution_time');
+if ($maxExecTime === 0 || $maxExecTime >= $requirements['min_max_execution_time']) {
+    $checks['max_execution_time'] = ['status' => 'ok', 'message' => (string)$maxExecTime];
+} else {
+    $checks['max_execution_time'] = [
+        'status' => 'warning',
+        'message' => sprintf('%ds is below the recommended minimum %ds', $maxExecTime, $requirements['min_max_execution_time'])
+    ];
+}
+
 // Calculate response time
 $responseTime = round((microtime(true) - $startTime) * 1000, 2);

@@ -225,10 +225,21 @@ foreach ($all as $row) {
        'comment' => "{$row['actor_name']} commented on ticket #{$ticketId}",
        'mention' => "{$row['actor_name']} mentioned you on ticket #{$ticketId}",
        'update'  => (function () use ($row, $details, $ticketId) {
-            // logTicketUpdate stores delta as {"status": {"from": "Open", "to": "In Progress"}}
-            $from = $details['status']['from'] ?? ($details['old_value'] ?? '?');
-            $to   = $details['status']['to']   ?? ($details['new_value'] ?? '?');
-            return "{$row['actor_name']} changed status on #{$ticketId}: {$from} → {$to}";
+            // Visibility changes log a flat {field, from, to} shape (api/update_ticket.php).
+            if (isset($details['field'], $details['from'], $details['to'])) {
+                return "{$row['actor_name']} changed {$details['field']} on #{$ticketId}: {$details['from']} → {$details['to']}";
+            }
+
+            // Single/bulk field updates log a per-field delta, e.g.
+            // {"status": {"from": "Open", "to": "In Progress"}}. Only one field
+            // changed at a time is reported, in priority order below.
+            foreach (['status', 'priority', 'title', 'category', 'type', 'description'] as $field) {
+                if (isset($details[$field]['from'], $details[$field]['to'])) {
+                    return "{$row['actor_name']} changed {$field} on #{$ticketId}: {$details[$field]['from']} → {$details[$field]['to']}";
+                }
+            }
+
+            return "{$row['actor_name']} updated ticket #{$ticketId}";
        })(),
        default   => "{$row['actor_name']} updated ticket #{$ticketId}",
    };
@@ -29,6 +29,73 @@ require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';

 header('Content-Type: application/json');

+/**
+ * Strip EXIF/metadata (including GPS) from an image file in place by
+ * decoding and re-encoding it via GD, which drops metadata chunks that
+ * aren't part of the pixel data. Best-effort: leaves the file untouched on
+ * any failure (corrupt image, unsupported format, GD unavailable) rather
+ * than blocking the upload — original bytes are what would have been stored
+ * anyway before this existed.
+ *
+ * download_attachment.php streams attachments back byte-for-byte to any user
+ * with ticket visibility, so an unstripped phone photo's embedded GPS data
+ * would otherwise leak a data center/office's physical location even on a
+ * Confidential-visibility ticket.
+ */
+function stripImageMetadata(string $path, string $mimeType): void
+{
+    if (!extension_loaded('gd')) {
+        return;
+    }
+
+    // Guard against a decompression-bomb-style crafted image (small file,
+    // huge decoded pixel buffer) exhausting memory during decode.
+    $dims = @getimagesize($path);
+    if ($dims === false) {
+        return;
+    }
+    [$width, $height] = $dims;
+    if ($width * $height > 40_000_000) { // ~40 MP cap
+        return;
+    }
+
+    $loaders = [
+        'image/jpeg' => 'imagecreatefromjpeg',
+        'image/png'  => 'imagecreatefrompng',
+        'image/gif'  => 'imagecreatefromgif',
+        'image/webp' => 'imagecreatefromwebp',
+    ];
+    $loader = $loaders[$mimeType] ?? null;
+    if ($loader === null || !function_exists($loader)) {
+        return;
+    }
+
+    $image = @$loader($path);
+    if ($image === false) {
+        return;
+    }
+
+    // Preserve transparency for formats that support it.
+    imagesavealpha($image, true);
+    imagealphablending($image, false);
+
+    $tmpPath = $path . '.tmp';
+    $saved = match ($mimeType) {
+        'image/jpeg' => imagejpeg($image, $tmpPath, 90),
+        'image/png'  => imagepng($image, $tmpPath, 6),
+        'image/gif'  => imagegif($image, $tmpPath),
+        'image/webp' => imagewebp($image, $tmpPath, 90),
+        default      => false,
+    };
+    imagedestroy($image);
+
+    if ($saved && file_exists($tmpPath)) {
+        rename($tmpPath, $path);
+    } elseif (file_exists($tmpPath)) {
+        unlink($tmpPath);
+    }
+}
+
 // Check authentication
 if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
    ResponseHelper::unauthorized();
@@ -127,6 +194,23 @@ if ($file['size'] > $maxSize) {
    ResponseHelper::error('File size exceeds maximum allowed (' . AttachmentModel::formatFileSize($maxSize) . ')');
 }

+// Check per-ticket attachment count/storage quota — bounds an authenticated
+// low-privilege user slowly filling the uploads/ disk across many tickets,
+// which was previously bounded only by the request-rate limiter, not volume.
+$attachmentModel = new AttachmentModel($conn);
+$maxAttachments = $GLOBALS['config']['MAX_ATTACHMENTS_PER_TICKET'] ?? 50;
+if ($attachmentModel->getAttachmentCount($ticketId) >= $maxAttachments) {
+    ResponseHelper::error("This ticket already has the maximum of {$maxAttachments} attachments");
+}
+
+$maxTotalSize = $GLOBALS['config']['MAX_TOTAL_ATTACHMENT_SIZE_PER_TICKET'] ?? 104857600;
+if ($attachmentModel->getTotalSizeForTicket($ticketId) + $file['size'] > $maxTotalSize) {
+    ResponseHelper::error(
+        'This upload would exceed the ticket\'s total attachment size limit of '
+        . AttachmentModel::formatFileSize($maxTotalSize)
+    );
+}
+
 // Get MIME type
 $finfo = new finfo(FILEINFO_MIME_TYPE);
 $mimeType = $finfo->file($file['tmp_name']);
@@ -184,6 +268,11 @@ if (!move_uploaded_file($file['tmp_name'], $targetPath)) {
    ResponseHelper::serverError('Failed to move uploaded file');
 }

+// Strip EXIF/GPS metadata from image uploads before it's ever served back
+if (str_starts_with($mimeType, 'image/')) {
+    stripImageMetadata($targetPath, $mimeType);
+}
+
 // Sanitize original filename
 $originalFilename = basename($file['name']);
 $originalFilename = preg_replace('/[^\w\s\-\.]/', '', $originalFilename);
@@ -193,7 +282,6 @@ if (empty($originalFilename)) {

 // Save to database
 try {
-    $attachmentModel = new AttachmentModel($conn);
    $attachmentId = $attachmentModel->addAttachment(
        $ticketId,
        $uniqueFilename,
@@ -87,11 +87,17 @@ function performAdvancedSearch(event) {
        params.set('search', searchText);
    }

-    // Date ranges
-    const createdFrom = document.getElementById('adv-created-from').value;
-    const createdTo = document.getElementById('adv-created-to').value;
-    const updatedFrom = document.getElementById('adv-updated-from').value;
-    const updatedTo = document.getElementById('adv-updated-to').value;
+    // Date ranges — swap if the user entered an end date before the start date
+    let createdFrom = document.getElementById('adv-created-from').value;
+    let createdTo = document.getElementById('adv-created-to').value;
+    if (createdFrom && createdTo && createdFrom > createdTo) {
+        [createdFrom, createdTo] = [createdTo, createdFrom];
+    }
+    let updatedFrom = document.getElementById('adv-updated-from').value;
+    let updatedTo = document.getElementById('adv-updated-to').value;
+    if (updatedFrom && updatedTo && updatedFrom > updatedTo) {
+        [updatedFrom, updatedTo] = [updatedTo, updatedFrom];
+    }

    if (createdFrom) params.set('created_from', createdFrom);
    if (createdTo) params.set('created_to', createdTo);
@@ -105,9 +111,12 @@ function performAdvancedSearch(event) {
        params.set('status', selectedStatuses.join(','));
    }

-    // Priority range
-    const priorityMin = document.getElementById('adv-priority-min').value;
-    const priorityMax = document.getElementById('adv-priority-max').value;
+    // Priority range — swap if min > max so the range is always satisfiable
+    let priorityMin = document.getElementById('adv-priority-min').value;
+    let priorityMax = document.getElementById('adv-priority-max').value;
+    if (priorityMin && priorityMax && Number(priorityMin) > Number(priorityMax)) {
+        [priorityMin, priorityMax] = [priorityMax, priorityMin];
+    }
    if (priorityMin) params.set('priority_min', priorityMin);
    if (priorityMax) params.set('priority_max', priorityMax);

@@ -2475,6 +2475,101 @@

      list.addEventListener('drop', e => { e.preventDefault(); });

+      // Touch fallback — iOS Safari doesn't implement HTML5 drag-and-drop on
+      // arbitrary elements at all, and mobile Chrome's support is poor, so
+      // kanban drag was effectively unusable via touch without this. Touch
+      // events for a given touch point are always dispatched to the element
+      // touchstart fired on (per spec), so per-list local state here is safe;
+      // cross-list moves are resolved via elementFromPoint against the live
+      // finger position, same as dragover does via e.target above.
+      const DRAG_THRESHOLD = 8; // px of movement before a touch starts a drag
+      let _touchItem = null, _touchDragging = false;
+      let _touchStartX = 0, _touchStartY = 0, _touchOffsetX = 0, _touchOffsetY = 0;
+
+      function _touchTargetList(x, y) {
+        const el = document.elementFromPoint(x, y);
+        const found = el ? el.closest('[data-sortable-group]') : null;
+        return found && (found === list || _sameGroup(found)) ? found : null;
+      }
+
+      list.addEventListener('touchstart', e => {
+        const item = e.target.closest('[data-sortable-item]');
+        if (!item || !list.contains(item)) return;
+        if (handle && !e.target.closest(handle)) return;
+        const t = e.touches[0];
+        _touchItem = item;
+        _touchDragging = false;
+        _touchStartX = t.clientX;
+        _touchStartY = t.clientY;
+      }, { passive: true });
+
+      // touchmove/touchend/touchcancel are registered on document, not list:
+      // once the dragged item is reparented to document.body below, it's no
+      // longer a descendant of list, so events targeting it (touch events
+      // keep targeting their touchstart element for the whole gesture) would
+      // stop bubbling to a listener on list.
+      document.addEventListener('touchmove', e => {
+        if (!_touchItem) return;
+        const t = e.touches[0];
+
+        if (!_touchDragging) {
+          if (Math.abs(t.clientX - _touchStartX) < DRAG_THRESHOLD && Math.abs(t.clientY - _touchStartY) < DRAG_THRESHOLD) return;
+          // Drag intent confirmed — take over from here, blocking page scroll.
+          _touchDragging = true;
+          _srtDragging = _touchItem;
+          _srtSrcList  = list;
+          _srtPlaceholder = _makePlaceholder(_touchItem);
+          _touchItem.classList.add('is-dragging');
+          const rect = _touchItem.getBoundingClientRect();
+          _touchOffsetX = _touchStartX - rect.left;
+          _touchOffsetY = _touchStartY - rect.top;
+          _touchItem.parentNode.insertBefore(_srtPlaceholder, _touchItem);
+          _touchItem.style.position = 'fixed';
+          _touchItem.style.zIndex = '1000';
+          _touchItem.style.width = rect.width + 'px';
+          _touchItem.style.pointerEvents = 'none';
+          document.body.appendChild(_touchItem); // avoid clipping by an overflow:hidden ancestor
+        }
+
+        e.preventDefault();
+        _touchItem.style.left = (t.clientX - _touchOffsetX) + 'px';
+        _touchItem.style.top  = (t.clientY - _touchOffsetY) + 'px';
+
+        const targetList = _touchTargetList(t.clientX, t.clientY);
+        if (!targetList) return;
+        const overEl = document.elementFromPoint(t.clientX, t.clientY);
+        const over = overEl ? overEl.closest('[data-sortable-item]') : null;
+        if (over && over !== _srtDragging && targetList.contains(over)) {
+          const rect = over.getBoundingClientRect();
+          targetList.insertBefore(_srtPlaceholder, t.clientY < rect.top + rect.height / 2 ? over : over.nextSibling);
+        } else if (!targetList.contains(_srtPlaceholder)) {
+          targetList.appendChild(_srtPlaceholder);
+        }
+      }, { passive: false });
+
+      function _touchEnd() {
+        if (_touchDragging && _srtDragging) {
+          _srtDragging.classList.remove('is-dragging');
+          _srtDragging.style.position = '';
+          _srtDragging.style.zIndex = '';
+          _srtDragging.style.width = '';
+          _srtDragging.style.pointerEvents = '';
+          _srtDragging.style.left = '';
+          _srtDragging.style.top = '';
+          if (_srtPlaceholder && _srtPlaceholder.parentNode) {
+            _srtPlaceholder.parentNode.insertBefore(_srtDragging, _srtPlaceholder);
+            _srtPlaceholder.remove();
+          }
+          if (onSort) onSort(_getItems(), _srtDragging);
+          bus.emit('sortable:change', { list, items: _getItems(), moved: _srtDragging });
+        }
+        _touchItem = null; _touchDragging = false;
+        _srtDragging = null; _srtPlaceholder = null; _srtSrcList = null;
+      }
+
+      document.addEventListener('touchend', _touchEnd);
+      document.addEventListener('touchcancel', _touchEnd);
+
      return {
        refresh() { Array.from(list.children).forEach(child => { if (!child.hasAttribute('data-sortable-item')) _mark(child); }); },
        getOrder: () => _getItems().map(el => el.dataset.id || el.textContent.trim()),
@@ -297,8 +297,12 @@ function clearAllFilters() {
    params.delete('type');
    params.delete('assigned_to');
    params.delete('search');
-    params.delete('date_from');
-    params.delete('date_to');
+    params.delete('created_from');
+    params.delete('created_to');
+    params.delete('updated_from');
+    params.delete('updated_to');
+    params.delete('closed_from');
+    params.delete('closed_to');
    params.delete('page');

    // Keep sort parameters
@@ -381,73 +385,6 @@ function initSettingsModal() {
    }
 }

-function sortTable(table, column) {
-    const headers = table.querySelectorAll('th');
-    headers.forEach(header => {
-        header.classList.remove('sort-asc', 'sort-desc');
-    });
-
-    const rows = Array.from(table.querySelectorAll('tbody tr'));
-    const currentDirection = table.dataset.sortColumn == column 
-        ? (table.dataset.sortDirection === 'asc' ? 'desc' : 'asc')
-        : 'asc';
-    
-    table.dataset.sortColumn = column;
-    table.dataset.sortDirection = currentDirection;
-    
-    rows.sort((a, b) => {
-        const aValue = a.children[column].textContent.trim();
-        const bValue = b.children[column].textContent.trim();
-
-        // Check if this is a date column — prefer data-ts attribute over text (which may be relative)
-        const headerText = headers[column].textContent.toLowerCase();
-        if (headerText === 'created' || headerText === 'updated') {
-            const cellA = a.children[column];
-            const cellB = b.children[column];
-            const dateA = new Date(cellA.dataset.ts || aValue);
-            const dateB = new Date(cellB.dataset.ts || bValue);
-            return currentDirection === 'asc' ? dateA - dateB : dateB - dateA;
-        }
-
-        // Special handling for "Assigned To" column
-        if (headerText === 'assigned to') {
-            const aUnassigned = aValue === 'Unassigned';
-            const bUnassigned = bValue === 'Unassigned';
-
-            // Both unassigned - equal
-            if (aUnassigned && bUnassigned) return 0;
-
-            // Put unassigned at the end regardless of sort direction
-            if (aUnassigned) return 1;
-            if (bUnassigned) return -1;
-
-            // Otherwise sort names normally
-            return currentDirection === 'asc'
-                ? aValue.localeCompare(bValue)
-                : bValue.localeCompare(aValue);
-        }
-
-        // Numeric comparison
-        const numA = parseFloat(aValue);
-        const numB = parseFloat(bValue);
-
-        if (!isNaN(numA) && !isNaN(numB)) {
-            return currentDirection === 'asc' ? numA - numB : numB - numA;
-        }
-
-        // String comparison
-        return currentDirection === 'asc'
-            ? aValue.localeCompare(bValue)
-            : bValue.localeCompare(aValue);
-    });
-    
-    const currentHeader = headers[column];
-    currentHeader.classList.add(currentDirection === 'asc' ? 'sort-asc' : 'sort-desc');
-    
-    const tbody = table.querySelector('tbody');
-    rows.forEach(row => tbody.appendChild(row));
-}
-
 // Old settings modal functions removed - now using settings.js with new settings modal


@@ -1135,12 +1072,11 @@ function quickAssign(ticketId) {
                <div class="lt-modal-body">
                    <p class="lt-mb-xs lt-text-muted lt-text-xs">Ticket #${lt.escHtml(String(ticketId))}</p>
                    <label class="lt-label">Assign to:</label>
-                    <div class="lt-combobox" id="quickAssignCombobox">
-                        <div class="lt-combobox-input-wrap">
-                            <input type="text" class="lt-combobox-input" id="quickAssignInput"
-                                   placeholder="Search users…" autocomplete="off" aria-label="Search users">
-                        </div>
-                        <ul class="lt-combobox-list" role="listbox" aria-hidden="true"></ul>
+                    <div class="lt-typeahead" id="quickAssignTypeahead" style="position:relative">
+                        <input type="text" class="lt-input lt-w-full" id="quickAssignInput"
+                               placeholder="Search users…" autocomplete="off" spellcheck="false"
+                               aria-label="Search users" aria-autocomplete="list">
+                        <div class="lt-typeahead-dropdown" id="quickAssignDropdown"></div>
                    </div>
                </div>
                <div class="lt-modal-footer">
@@ -1166,7 +1102,9 @@ function quickAssign(ticketId) {
                        label: u.display_name || u.username
                    }))
                ];
-                lt.combobox.init(input, items, {
+                lt.typeahead.init(input, items, {
+                    minChars: 1,
+                    maxResults: 8,
                    onSelect: function(item) { _quickAssignUserId = item.value || null; }
                });
            }
@@ -1215,7 +1153,6 @@ function setViewMode(mode) {
    if (mode === 'card') {
        populateKanbanCards();
    }
-    localStorage.setItem('ticketViewMode', mode);
 }

 /**
@@ -354,6 +354,33 @@ window.renderMarkdownElements = renderMarkdownElements;
 // Rich Text Editor Toolbar Functions
 // ========================================

+/**
+ * Replace textarea.value.substring(selStart, selEnd) with replacementText,
+ * preserving the browser's native undo/redo stack via
+ * document.execCommand('insertText', ...) -- the same mechanism real typing
+ * uses -- instead of a direct .value assignment, which discards the entire
+ * undo history. Falls back to a direct assignment (losing undo, matching the
+ * old behavior) only if execCommand is unavailable or unsuccessful.
+ */
+function insertTextPreservingUndo(textarea, replacementText, selStart, selEnd) {
+    textarea.focus();
+    textarea.setSelectionRange(selStart, selEnd);
+
+    let inserted = false;
+    if (typeof document.execCommand === 'function') {
+        try {
+            inserted = document.execCommand('insertText', false, replacementText);
+        } catch (e) {
+            inserted = false;
+        }
+    }
+
+    if (!inserted) {
+        const text = textarea.value;
+        textarea.value = text.substring(0, selStart) + replacementText + text.substring(selEnd);
+    }
+}
+
 /**
 * Insert markdown formatting around selection
 */
@@ -363,16 +390,13 @@ function insertMarkdownFormat(textareaId, prefix, suffix) {

    const start = textarea.selectionStart;
    const end = textarea.selectionEnd;
-    const text = textarea.value;
-    const selectedText = text.substring(start, end);
+    const selectedText = textarea.value.substring(start, end);

-    // Insert formatting
-    const newText = text.substring(0, start) + prefix + selectedText + suffix + text.substring(end);
-    textarea.value = newText;
+    insertTextPreservingUndo(textarea, prefix + selectedText + suffix, start, end);

    // Set cursor position
    if (selectedText) {
-        textarea.setSelectionRange(start + prefix.length, end + prefix.length);
+        textarea.setSelectionRange(start + prefix.length, start + prefix.length + selectedText.length);
    } else {
        textarea.setSelectionRange(start + prefix.length, start + prefix.length);
    }
@@ -391,9 +415,10 @@ function insertMarkdownText(textareaId, text) {
    if (!textarea) return;

    const start = textarea.selectionStart;
-    const value = textarea.value;

-    textarea.value = value.substring(0, start) + text + value.substring(start);
+    // Matches the prior behavior: insert before the selection start without
+    // deleting any currently-selected text (a collapsed replace range).
+    insertTextPreservingUndo(textarea, text, start, start);
    textarea.setSelectionRange(start + text.length, start + text.length);
    textarea.focus();

@@ -453,7 +478,7 @@ function toolbarList(textareaId) {
    }

    // Insert list marker at beginning of line
-    textarea.value = text.substring(0, lineStart) + '- ' + text.substring(lineStart);
+    insertTextPreservingUndo(textarea, '- ', lineStart, lineStart);
    textarea.setSelectionRange(start + 2, start + 2);
    textarea.focus();

@@ -474,7 +499,7 @@ function toolbarHeading(textareaId) {
    }

    // Insert heading marker at beginning of line
-    textarea.value = text.substring(0, lineStart) + '## ' + text.substring(lineStart);
+    insertTextPreservingUndo(textarea, '## ', lineStart, lineStart);
    textarea.setSelectionRange(start + 3, start + 3);
    textarea.focus();

@@ -495,7 +520,7 @@ function toolbarQuote(textareaId) {
    }

    // Insert quote marker at beginning of line
-    textarea.value = text.substring(0, lineStart) + '> ' + text.substring(lineStart);
+    insertTextPreservingUndo(textarea, '> ', lineStart, lineStart);
    textarea.setSelectionRange(start + 2, start + 2);
    textarea.focus();

@@ -183,15 +183,35 @@ function toggleEditMode() {
 }

 /**
- * Compute avatar color class from display name (mirrors PHP crc32 % 4 logic)
+ * CRC-32 (IEEE 802.3 / zlib polynomial), matching PHP's crc32(). Operates on
+ * the UTF-8 byte sequence, same as PHP, so results agree for non-ASCII names.
+ */
+function crc32(str) {
+    var bytes = unescape(encodeURIComponent(str));
+    var table = crc32._table || (crc32._table = (function () {
+        var t = [];
+        for (var n = 0; n < 256; n++) {
+            var c = n;
+            for (var k = 0; k < 8; k++) {
+                c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
+            }
+            t[n] = c;
+        }
+        return t;
+    })());
+    var crc = -1;
+    for (var i = 0; i < bytes.length; i++) {
+        crc = (crc >>> 8) ^ table[(crc ^ bytes.charCodeAt(i)) & 0xFF];
+    }
+    return (crc ^ -1) >>> 0;
+}
+
+/**
+ * Compute avatar color class from display name (mirrors PHP's crc32 % 4 logic)
 */
 function avatarColorClass(displayName) {
    var colors = ['lt-avatar--orange', 'lt-avatar--green', 'lt-avatar--purple', ''];
-    var h = 0;
-    for (var i = 0; i < displayName.length; i++) {
-        h = ((h << 5) - h + displayName.charCodeAt(i)) | 0;
-    }
-    return colors[Math.abs(h) % 4];
+    return colors[crc32(displayName) % 4];
 }

 /**
@@ -1048,7 +1068,7 @@ function renderAttachments(attachments) {
        });
        const uploadDate = `<span class="ts-cell" data-ts="${lt.escHtml(att.uploaded_at)}" title="${lt.escHtml(uploadDateFormatted)}">${lt.time.ago(att.uploaded_at)}</span>`;

-        const isImage = /\.(png|jpe?g|gif|webp|svg|bmp)$/i.test(att.original_filename);
+        const isImage = /^image\//i.test(att.mime_type || '');
        const imgUrl  = `/api/download_attachment.php?id=${att.attachment_id}&inline=1`;
        const iconHtml = isImage
            ? `<a href="${imgUrl}" class="lt-lightbox-trigger" data-lightbox="ticket-attachments" title="${lt.escHtml(att.original_filename)}">
@@ -115,6 +115,8 @@ $GLOBALS['config'] = [

    // File upload settings
    'MAX_UPLOAD_SIZE' => 10485760, // 10MB in bytes
+    'MAX_ATTACHMENTS_PER_TICKET' => 50,
+    'MAX_TOTAL_ATTACHMENT_SIZE_PER_TICKET' => 104857600, // 100MB in bytes
    'ALLOWED_FILE_TYPES' => [
        'image/jpeg',
        'image/png',
@@ -25,4 +25,11 @@ return [
        'fileinfo', // api/upload_attachment.php — MIME validation
        'json',     // request/response encoding (bundled, but assert anyway)
    ],
+
+    // Sanity-check thresholds (warnings, not hard failures). A host with a low
+    // default memory_limit passes a bare extension/version check cleanly and
+    // only surfaces as a mysterious failure under real load — a large CSV
+    // export, an oversized dashboard query on a big install.
+    'min_memory_limit_mb' => 256,
+    'min_max_execution_time' => 30, // seconds; 0 (unlimited) always passes
 ];
@@ -121,6 +121,33 @@ class CacheHelper
        return $written;
    }

+    /**
+     * Read the current invalidation epoch for a prefix (0 if never bumped).
+     * Used by remember() to detect an invalidation that happened while a
+     * cache-miss recomputation was in flight.
+     */
+    private static function getEpoch(string $prefix): int
+    {
+        $safePrefix = preg_replace('/[^a-zA-Z0-9_]/', '_', $prefix);
+        $file = self::getCacheDir() . '/' . $safePrefix . '.epoch';
+        $val = @file_get_contents($file);
+        return $val !== false ? (int)$val : 0;
+    }
+
+    /**
+     * Bump a prefix's invalidation epoch. Called whenever anything under the
+     * prefix is invalidated.
+     */
+    private static function bumpEpoch(string $prefix): void
+    {
+        $safePrefix = preg_replace('/[^a-zA-Z0-9_]/', '_', $prefix);
+        $file = self::getCacheDir() . '/' . $safePrefix . '.epoch';
+        $next = self::getEpoch($prefix) + 1;
+        if (@file_put_contents($file, (string)$next, LOCK_EX) !== false) {
+            @chmod($file, 0600);
+        }
+    }
+
    /**
     * Delete cached data
     *
@@ -130,6 +157,8 @@ class CacheHelper
     */
    public static function delete(string $prefix, $identifier = null): bool
    {
+        self::bumpEpoch($prefix);
+
        if ($identifier !== null) {
            $key = self::makeKey($prefix, $identifier);
            unset(self::$memoryCache[$key]);
@@ -192,8 +221,14 @@ class CacheHelper
        $data = self::get($prefix, $identifier, $ttl);

        if ($data === null) {
+            // Snapshot the epoch before running the (possibly slow) callback so
+            // a concurrent invalidation mid-computation can be detected below —
+            // otherwise this request's stale pre-invalidation result could
+            // overwrite a newer request's fresher write, extending staleness by
+            // up to another full TTL.
+            $epochBefore = self::getEpoch($prefix);
            $data = $callback();
-            if ($data !== null) {
+            if ($data !== null && self::getEpoch($prefix) === $epochBefore) {
                self::set($prefix, $identifier, $data);
            }
        }
@@ -1,212 +0,0 @@
-<?php
-
-/**
- * OutputHelper - Consistent output escaping utilities
- *
- * Provides secure HTML escaping functions to prevent XSS attacks.
- * Use these functions when outputting user-controlled data.
- */
-class OutputHelper
-{
-    /**
-     * Escape string for HTML output
-     *
-     * Use for text content inside HTML elements.
-     * Example: <p><?= OutputHelper::h($userInput) ?></p>
-     *
-     * @param string|null $string The string to escape
-     * @param int $flags htmlspecialchars flags (default: ENT_QUOTES | ENT_HTML5)
-     * @return string Escaped string
-     */
-    public static function h(?string $string, int $flags = ENT_QUOTES | ENT_HTML5): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        return htmlspecialchars($string, $flags, 'UTF-8');
-    }
-
-    /**
-     * Escape string for HTML attribute context
-     *
-     * Use for values inside HTML attributes.
-     * Example: <input value="<?= OutputHelper::attr($userInput) ?>">
-     *
-     * @param string|null $string The string to escape
-     * @return string Escaped string
-     */
-    public static function attr(?string $string): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        // More aggressive escaping for attribute context
-        return htmlspecialchars($string, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE, 'UTF-8');
-    }
-
-    /**
-     * Encode data as JSON for JavaScript context
-     *
-     * Use when embedding data in JavaScript.
-     * Example: <script>const data = <?= OutputHelper::json($data) ?>;</script>
-     *
-     * @param mixed $data The data to encode
-     * @param int $flags json_encode flags
-     * @return string JSON encoded string (safe for script context)
-     */
-    public static function json($data, int $flags = 0): string
-    {
-        // Use HEX encoding for safety in HTML context
-        $safeFlags = JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP | $flags;
-        return json_encode($data, $safeFlags);
-    }
-
-    /**
-     * URL encode a string
-     *
-     * Use for values in URL query strings.
-     * Example: <a href="/search?q=<?= OutputHelper::url($query) ?>">
-     *
-     * @param string|null $string The string to encode
-     * @return string URL encoded string
-     */
-    public static function url(?string $string): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        return rawurlencode($string);
-    }
-
-    /**
-     * Escape for CSS context
-     *
-     * Use for values in inline CSS.
-     * Example: <div style="color: <?= OutputHelper::css($color) ?>;">
-     *
-     * @param string|null $string The string to escape
-     * @return string Escaped string (only allows safe characters)
-     */
-    public static function css(?string $string): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        // Only allow alphanumeric, hyphens, underscores, spaces, and common CSS values
-        if (!preg_match('/^[a-zA-Z0-9_\-\s#.,()%]+$/', $string)) {
-            return '';
-        }
-        return $string;
-    }
-
-    /**
-     * Format a number safely
-     *
-     * Ensures output is always a valid number.
-     *
-     * @param mixed $number The number to format
-     * @param int $decimals Number of decimal places
-     * @return string Formatted number
-     */
-    public static function number($number, int $decimals = 0): string
-    {
-        return number_format((float)$number, $decimals, '.', ',');
-    }
-
-    /**
-     * Format an integer safely
-     *
-     * @param mixed $value The value to format
-     * @return int Integer value
-     */
-    public static function int($value): int
-    {
-        return (int)$value;
-    }
-
-    /**
-     * Truncate string with ellipsis
-     *
-     * @param string|null $string The string to truncate
-     * @param int $length Maximum length
-     * @param string $suffix Suffix to add if truncated
-     * @return string Truncated and escaped string
-     */
-    public static function truncate(?string $string, int $length = 100, string $suffix = '...'): string
-    {
-        if ($string === null) {
-            return '';
-        }
-
-        if (mb_strlen($string, 'UTF-8') <= $length) {
-            return self::h($string);
-        }
-
-        return self::h(mb_substr($string, 0, $length, 'UTF-8')) . self::h($suffix);
-    }
-
-    /**
-     * Format a date safely
-     *
-     * @param string|int|null $date Date string, timestamp, or null
-     * @param string $format PHP date format
-     * @return string Formatted date
-     */
-    public static function date($date, string $format = 'Y-m-d H:i:s'): string
-    {
-        if ($date === null || $date === '') {
-            return '';
-        }
-
-        if (is_numeric($date)) {
-            return date($format, (int)$date);
-        }
-
-        $timestamp = strtotime($date);
-        if ($timestamp === false) {
-            return '';
-        }
-
-        return date($format, $timestamp);
-    }
-
-    /**
-     * Check if a string is safe for use as a CSS class name
-     *
-     * @param string $class The class name to validate
-     * @return bool True if safe
-     */
-    public static function isValidCssClass(string $class): bool
-    {
-        return preg_match('/^[a-zA-Z_][a-zA-Z0-9_-]*$/', $class) === 1;
-    }
-
-    /**
-     * Sanitize CSS class name(s)
-     *
-     * @param string|null $classes Space-separated class names
-     * @return string Sanitized class names
-     */
-    public static function cssClass(?string $classes): string
-    {
-        if ($classes === null || $classes === '') {
-            return '';
-        }
-
-        $classList = explode(' ', $classes);
-        $validClasses = array_filter($classList, [self::class, 'isValidCssClass']);
-
-        return implode(' ', $validClasses);
-    }
-}
-
-/**
- * Shorthand function for HTML escaping
- *
- * @param string|null $string The string to escape
- * @return string Escaped string
- */
-function h(?string $string): string
-{
-    return OutputHelper::h($string);
-}
@@ -391,13 +391,16 @@ switch (true) {
                LEFT JOIN (
                    SELECT user_id, MAX(created_at) as last_activity
                    FROM audit_log
+                    WHERE DATE(created_at) BETWEEN ? AND ?
                    GROUP BY user_id
                ) al ON u.user_id = al.user_id
                ORDER BY tickets_created DESC, tickets_resolved DESC";

        $stmt = $conn->prepare($sql);
        $stmt->bind_param(
-            'ssssssss',
+            'ssssssssss',
+            $dateRange['from'],
+            $dateRange['to'],
            $dateRange['from'],
            $dateRange['to'],
            $dateRange['from'],
@@ -57,7 +57,7 @@ CREATE TABLE IF NOT EXISTS `bulk_operations` (
  `operation_id` int(11) NOT NULL AUTO_INCREMENT,
  `operation_type` varchar(50) NOT NULL,
  `ticket_ids` text NOT NULL,
-  `performed_by` int(11) NOT NULL,
+  `performed_by` int(11) DEFAULT NULL,
  `parameters` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`parameters`)),
  -- 32, not 20: 'completed_with_errors' is 21 chars (see 001_widen_bulk_operations_status.sql)
  `status` varchar(32) DEFAULT 'pending',
@@ -69,7 +69,7 @@ CREATE TABLE IF NOT EXISTS `bulk_operations` (
  PRIMARY KEY (`operation_id`),
  KEY `idx_performed_by` (`performed_by`),
  KEY `idx_created_at` (`created_at`),
-  CONSTRAINT `bulk_operations_ibfk_1` FOREIGN KEY (`performed_by`) REFERENCES `users` (`user_id`)
+  CONSTRAINT `bulk_operations_ibfk_1` FOREIGN KEY (`performed_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

 -- ============ custom_field_definitions ============
@@ -155,7 +155,7 @@ CREATE TABLE IF NOT EXISTS `saved_filters` (
  UNIQUE KEY `unique_user_filter_name` (`user_id`,`filter_name`),
  KEY `idx_user_filters` (`user_id`,`is_default`),
  CONSTRAINT `saved_filters_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`user_id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

 -- ============ status_transitions ============
 CREATE TABLE IF NOT EXISTS `status_transitions` (
@@ -185,7 +185,7 @@ CREATE TABLE IF NOT EXISTS `ticket_attachments` (
  KEY `idx_attachments_ticket` (`ticket_id`),
  KEY `idx_attachments_uploaded_by` (`uploaded_by`),
  CONSTRAINT `ticket_attachments_ibfk_1` FOREIGN KEY (`uploaded_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

 -- ============ ticket_comments ============
 CREATE TABLE IF NOT EXISTS `ticket_comments` (
@@ -238,7 +238,7 @@ CREATE TABLE IF NOT EXISTS `ticket_templates` (
  PRIMARY KEY (`template_id`),
  KEY `created_by` (`created_by`),
  KEY `idx_template_name` (`template_name`),
-  CONSTRAINT `ticket_templates_ibfk_1` FOREIGN KEY (`created_by`) REFERENCES `users` (`user_id`)
+  CONSTRAINT `ticket_templates_ibfk_1` FOREIGN KEY (`created_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

 -- ============ ticket_watchers ============
@@ -0,0 +1,30 @@
+-- Fix collation inconsistency on saved_filters and ticket_attachments
+--
+-- README.md Developer Notes #12: "Database collation: Use
+-- utf8mb4_general_ci (not unicode_ci) for new tables." These two tables
+-- were created with utf8mb4_unicode_ci instead, inconsistent with every
+-- other table in the schema. Mixed collations don't break anything by
+-- themselves, but any future query joining/comparing these columns
+-- against general_ci columns needs explicit COLLATE casts or hits
+-- "Illegal mix of collations" errors.
+--
+-- Safe to re-run.
+
+ALTER TABLE `saved_filters`
+    CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
+
+-- saved_filters.filter_criteria is pinned to utf8mb4_bin (for the
+-- json_valid() CHECK constraint) — restore that after the table-wide
+-- CONVERT TO above, which resets it to general_ci. MariaDB drops the
+-- inline CHECK when the column is MODIFYed, so re-add it explicitly.
+ALTER TABLE `saved_filters`
+    MODIFY COLUMN `filter_criteria` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL;
+
+ALTER TABLE `saved_filters`
+    DROP CONSTRAINT IF EXISTS `saved_filters_filter_criteria_json`;
+
+ALTER TABLE `saved_filters`
+    ADD CONSTRAINT `saved_filters_filter_criteria_json` CHECK (json_valid(`filter_criteria`));
+
+ALTER TABLE `ticket_attachments`
+    CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
@@ -0,0 +1,32 @@
+-- Fix inconsistent FK ON DELETE behavior on bulk_operations.performed_by and
+-- ticket_templates.created_by
+--
+-- Every other user-reference FK in the schema (tickets.created_by/updated_by/
+-- assigned_to, ticket_attachments.uploaded_by, ticket_dependencies.created_by,
+-- recurring_tickets.created_by/assigned_to, api_keys.created_by, etc.) uses
+-- ON DELETE SET NULL. These two had no ON DELETE clause at all, which
+-- defaults to RESTRICT — so deleting a user who ever ran a bulk operation or
+-- created a template hard-fails at the DB level instead of nulling the
+-- reference, breaking the pattern used everywhere else and potentially
+-- blocking legitimate user offboarding/cleanup.
+--
+-- bulk_operations.performed_by is NOT NULL today; it must become nullable to
+-- support SET NULL, matching how every other SET NULL column in the schema
+-- is defined.
+--
+-- Safe to re-run.
+
+ALTER TABLE `bulk_operations`
+    MODIFY COLUMN `performed_by` int(11) DEFAULT NULL;
+
+ALTER TABLE `bulk_operations`
+    DROP FOREIGN KEY IF EXISTS `bulk_operations_ibfk_1`;
+
+ALTER TABLE `bulk_operations`
+    ADD CONSTRAINT `bulk_operations_ibfk_1` FOREIGN KEY (`performed_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL;
+
+ALTER TABLE `ticket_templates`
+    DROP FOREIGN KEY IF EXISTS `ticket_templates_ibfk_1`;
+
+ALTER TABLE `ticket_templates`
+    ADD CONSTRAINT `ticket_templates_ibfk_1` FOREIGN KEY (`created_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL;
@@ -309,17 +309,28 @@ class AuditLogModel
     * @param int $daysToKeep Number of days of logs to keep
     * @return int Number of deleted records
     */
-    public function deleteOldLogs($daysToKeep = 90)
+    public function deleteOldLogs($daysToKeep = 90, $batchSize = 1000)
    {
+        // Batched to bound how long each statement holds row locks — an
+        // unbounded single DELETE on a large backlog (e.g. the first run after
+        // enabling/changing retention, or after the cron silently missed runs)
+        // would otherwise contend with the frequent concurrent INSERTs the
+        // audit log receives from live traffic.
        $stmt = $this->conn->prepare(
-            "DELETE FROM audit_log WHERE created_at < DATE_SUB(NOW(), INTERVAL ? DAY)"
+            "DELETE FROM audit_log WHERE created_at < DATE_SUB(NOW(), INTERVAL ? DAY) ORDER BY audit_id LIMIT ?"
        );
-        $stmt->bind_param("i", $daysToKeep);
-        $stmt->execute();
-        $affectedRows = $stmt->affected_rows;
+        $stmt->bind_param("ii", $daysToKeep, $batchSize);
+
+        $totalDeleted = 0;
+        do {
+            $stmt->execute();
+            $affected = $stmt->affected_rows;
+            $totalDeleted += $affected;
+        } while ($affected > 0);
+
        $stmt->close();

-        return $affectedRows;
+        return $totalDeleted;
    }

    /**
@@ -172,6 +172,27 @@ class DependencyModel
        }
        $checkStmt->close();

+        // Also check the semantic inverse: "A blocks B" and "B blocked_by A"
+        // describe the same relationship, so adding one from either ticket's
+        // page must be rejected as a duplicate of the other. relates_to is
+        // its own inverse (symmetric); duplicates has no defined inverse type.
+        $inverseTypes = ['blocks' => 'blocked_by', 'blocked_by' => 'blocks', 'relates_to' => 'relates_to'];
+        if (isset($inverseTypes[$type])) {
+            $inverseType = $inverseTypes[$type];
+            $checkInverseSql = "SELECT dependency_id FROM ticket_dependencies
+                                 WHERE ticket_id = ? AND depends_on_id = ? AND dependency_type = ?";
+            $checkInverseStmt = $this->conn->prepare($checkInverseSql);
+            $checkInverseStmt->bind_param("sss", $dependsOnId, $ticketId, $inverseType);
+            $checkInverseStmt->execute();
+            $inverseResult = $checkInverseStmt->get_result();
+
+            if ($inverseResult->num_rows > 0) {
+                $checkInverseStmt->close();
+                return ['success' => false, 'error' => 'This relationship already exists'];
+            }
+            $checkInverseStmt->close();
+        }
+
        // Check for circular dependency
        if ($this->wouldCreateCycle($ticketId, $dependsOnId, $type)) {
            return ['success' => false, 'error' => 'This would create a circular dependency'];
@@ -189,30 +189,6 @@ class RecurringTicketModel
        return $claimed;
    }

-    /**
-     * Update last run and calculate next run time
-     */
-    public function updateAfterRun($recurringId)
-    {
-        $recurring = $this->getById($recurringId);
-        if (!$recurring) {
-            return false;
-        }
-
-        $nextRun = $this->calculateNextRunTime(
-            $recurring['schedule_type'],
-            $recurring['schedule_day'],
-            $recurring['schedule_time']
-        );
-
-        $sql = "UPDATE recurring_tickets SET last_run_at = NOW(), next_run_at = ? WHERE recurring_id = ?";
-        $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param('si', $nextRun, $recurringId);
-        $success = $stmt->execute();
-        $stmt->close();
-        return $success;
-    }
-
    /**
     * Calculate the next run time based on schedule
     */
@@ -255,9 +231,33 @@ class RecurringTicketModel
     */
    public function toggleActive($recurringId)
    {
-        $sql = "UPDATE recurring_tickets SET is_active = NOT is_active WHERE recurring_id = ?";
-        $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param('i', $recurringId);
+        $recurring = $this->getById($recurringId);
+        if (!$recurring) {
+            return ['success' => false];
+        }
+
+        $newActive = $recurring['is_active'] ? 0 : 1;
+
+        if ($newActive) {
+            // Re-enabling: recompute next_run_at from now, as if the schedule
+            // were freshly created. Otherwise a schedule paused while
+            // next_run_at was still in the future, then re-enabled after that
+            // date has passed, would fire immediately on the next cron tick
+            // instead of waiting for its next natural occurrence.
+            $nextRun = $this->calculateNextRunTime(
+                $recurring['schedule_type'],
+                $recurring['schedule_day'],
+                $recurring['schedule_time']
+            );
+            $sql = "UPDATE recurring_tickets SET is_active = ?, next_run_at = ? WHERE recurring_id = ?";
+            $stmt = $this->conn->prepare($sql);
+            $stmt->bind_param('isi', $newActive, $nextRun, $recurringId);
+        } else {
+            $sql = "UPDATE recurring_tickets SET is_active = ? WHERE recurring_id = ?";
+            $stmt = $this->conn->prepare($sql);
+            $stmt->bind_param('ii', $newActive, $recurringId);
+        }
+
        $success = $stmt->execute();
        $stmt->close();
        return ['success' => $success];
@@ -98,19 +98,30 @@ class UserModel
            $user['groups'] = $groups;
            $user['is_admin'] = $isAdmin;
        } else {
-            // Create new user
+            // Create new user. Uses INSERT ... ON DUPLICATE KEY UPDATE (rather than
+            // a plain INSERT) so two concurrent first-visit requests for the same
+            // brand-new username can't race: the losing request updates the row the
+            // winner just created instead of throwing an uncaught duplicate-key
+            // exception (users.username has a UNIQUE KEY, and mysqli throws on
+            // constraint violation under PHP 8.1+'s default report mode).
            $insertStmt = $this->conn->prepare(
-                "INSERT INTO users (username, display_name, email, `groups`, is_admin, last_login) VALUES (?, ?, ?, ?, ?, NOW())"
+                "INSERT INTO users (username, display_name, email, `groups`, is_admin, last_login)
+                 VALUES (?, ?, ?, ?, ?, NOW())
+                 ON DUPLICATE KEY UPDATE
+                     display_name = VALUES(display_name),
+                     email        = VALUES(email),
+                     `groups`     = VALUES(groups),
+                     is_admin     = VALUES(is_admin),
+                     last_login   = NOW()"
            );
            $insertStmt->bind_param("ssssi", $username, $displayName, $email, $groups, $isAdmin);
            $insertStmt->execute();
-
-            $userId = $this->conn->insert_id;
            $insertStmt->close();

-            // Get the newly created user
-            $stmt = $this->conn->prepare("SELECT * FROM users WHERE user_id = ?");
-            $stmt->bind_param("i", $userId);
+            // Re-fetch by username — works whether this request won the insert or
+            // lost the race and only updated the winner's row.
+            $stmt = $this->conn->prepare("SELECT * FROM users WHERE username = ?");
+            $stmt->bind_param("s", $username);
            $stmt->execute();
            $result = $stmt->get_result();
            $user = $result->fetch_assoc();
@@ -10,9 +10,30 @@
 * Usage: php scripts/check_requirements.php
 */

+/**
+ * Parse a php.ini size value (e.g. "128M", "1G", "-1") into bytes.
+ * Returns -1 for unlimited.
+ */
+function parseIniBytes(string $val): int
+{
+    $val = trim($val);
+    if ($val === '' || $val === '-1') {
+        return -1;
+    }
+    $unit = strtolower(substr($val, -1));
+    $num = (int)$val;
+    return match ($unit) {
+        'g' => $num * 1024 * 1024 * 1024,
+        'm' => $num * 1024 * 1024,
+        'k' => $num * 1024,
+        default => $num,
+    };
+}
+
 $req = require __DIR__ . '/../config/requirements.php';

 $errors = [];
+$warnings = [];

 // PHP version
 $minPhp = $req['min_php_version'];
@@ -27,6 +48,28 @@ foreach ($req['required_extensions'] as $ext) {
    }
 }

+// memory_limit / max_execution_time sanity checks (warnings, not hard
+// failures — see config/requirements.php for why these matter).
+$memLimitIni = ini_get('memory_limit');
+$memLimitBytes = parseIniBytes($memLimitIni);
+$minMemBytes = $req['min_memory_limit_mb'] * 1024 * 1024;
+if ($memLimitBytes !== -1 && $memLimitBytes < $minMemBytes) {
+    $warnings[] = sprintf(
+        'memory_limit is %s, below the recommended minimum %dM',
+        $memLimitIni,
+        $req['min_memory_limit_mb']
+    );
+}
+
+$maxExecTime = (int)ini_get('max_execution_time');
+if ($maxExecTime !== 0 && $maxExecTime < $req['min_max_execution_time']) {
+    $warnings[] = sprintf(
+        'max_execution_time is %ds, below the recommended minimum %ds',
+        $maxExecTime,
+        $req['min_max_execution_time']
+    );
+}
+
 if (!empty($errors)) {
    fwrite(STDERR, "Requirement check FAILED:\n");
    foreach ($errors as $err) {
@@ -35,6 +78,10 @@ if (!empty($errors)) {
    exit(1);
 }

+foreach ($warnings as $warn) {
+    fwrite(STDERR, "Requirement check WARNING: " . $warn . "\n");
+}
+
 printf(
    "Requirement check passed: PHP %s (>= %s); extensions: %s\n",
    PHP_VERSION,
@@ -344,12 +344,23 @@ include __DIR__ . '/layout_header.php';
        var existingTitle = (document.getElementById('title').value || '').trim();
        var existingDesc  = (document.getElementById('description').value || '').trim();
        if (existingTitle || existingDesc) {
-            if (!confirm('Applying this template will overwrite your current title and description. Continue?')) {
-                document.getElementById('templateSelect').value = '';
-                return;
-            }
+            showConfirmModal(
+                'Overwrite content?',
+                'Applying this template will overwrite your current title and description. Continue?',
+                'warning',
+                applyTemplate,
+                function () { document.getElementById('templateSelect').value = ''; }
+            );
+            return;
        }

+        applyTemplate();
+    }
+
+    function applyTemplate() {
+        var tplId = document.getElementById('templateSelect').value;
+        if (!tplId) return;
+
        lt.api.get('/api/get_template.php?template_id=' + encodeURIComponent(tplId))
            .then(function (data) {
                if (!data.success || !data.template) {
@@ -120,7 +120,6 @@ include __DIR__ . '/layout_header.php';
    ?>

  <div class="lt-stat-card stat-open" role="button" tabindex="0"
-       data-filter-key="status" data-filter-val="Open,Pending,In Progress"
       title="Click to filter by active tickets" aria-label="Open tickets">
    <div class="lt-stat-icon">[ # ]</div>
    <div class="lt-stat-info">
@@ -133,7 +132,6 @@ include __DIR__ . '/layout_header.php';
  </div>

  <div class="lt-stat-card stat-critical" role="button" tabindex="0"
-       data-filter-key="priority" data-filter-val="1"
       title="Click to filter critical (P1) tickets" aria-label="Critical P1 tickets">
    <div class="lt-stat-icon lt-text-danger">[ ! ]</div>
    <div class="lt-stat-info">
@@ -146,7 +144,6 @@ include __DIR__ . '/layout_header.php';
  </div>

  <div class="lt-stat-card stat-unassigned" role="button" tabindex="0"
-       data-filter-key="assigned_to" data-filter-val="unassigned"
       title="Click to filter unassigned tickets" aria-label="Unassigned tickets">
    <div class="lt-stat-icon lt-text-amber">[ @ ]</div>
    <div class="lt-stat-info">
@@ -171,7 +168,6 @@ include __DIR__ . '/layout_header.php';
  </div>

  <div class="lt-stat-card stat-resolved" role="button" tabindex="0"
-       data-filter-key="status" data-filter-val="Closed"
       title="Click to filter closed tickets" aria-label="Closed tickets today">
    <div class="lt-stat-icon lt-text-muted">[ OK ]</div>
    <div class="lt-stat-info">
@@ -292,9 +288,10 @@ include __DIR__ . '/layout_header.php';
  }

  function gotoFilter(params) {
-    var qs = new URLSearchParams();
+    var qs = new URLSearchParams(window.location.search);
    Object.keys(params).forEach(function(k) {
      if (params[k] !== null && params[k] !== undefined && params[k] !== '') qs.set(k, params[k]);
+      else qs.delete(k);
    });
    window.location.href = '/?' + qs.toString();
  }
@@ -333,7 +330,8 @@ include __DIR__ . '/layout_header.php';

  function makeDonut(canvasId, data, colorMap) {
    var ctx = document.getElementById(canvasId);
-    if (!ctx || !data.length) return;
+    if (!ctx) return;
+    if (!data.length) { showChartEmptyState(ctx); return; }
    ctx.title = 'Click a segment to filter the ticket list';
    return new Chart(ctx, {
      type: 'doughnut',
@@ -364,9 +362,22 @@ include __DIR__ . '/layout_header.php';
    });
  }

+  function showChartEmptyState(canvas) {
+    canvas.style.display = 'none';
+    var wrap = canvas.parentElement;
+    if (wrap && !wrap.querySelector('.lt-chart-empty')) {
+      var msg = document.createElement('div');
+      msg.className = 'lt-chart-empty';
+      msg.style.cssText = 'display:flex;align-items:center;justify-content:center;height:100%;color:var(--text-muted);font-size:0.75rem';
+      msg.textContent = 'No data for current filters';
+      wrap.appendChild(msg);
+    }
+  }
+
  function makeBar(canvasId, data) {
    var ctx = document.getElementById(canvasId);
-    if (!ctx || !data.length) return;
+    if (!ctx) return;
+    if (!data.length) { showChartEmptyState(ctx); return; }
    ctx.title = 'Click a bar to filter the ticket list';
    return new Chart(ctx, {
      type: 'bar',
@@ -1225,7 +1236,6 @@ window.TICKET_STATUSES = <?= json_encode($GLOBALS['config']['TICKET_STATUSES'])
 if (window.lt) {
    lt.keys.initDefaults();
    lt.tableNav.init('tickets-table');
-    lt.statsFilter.init();
 }

 // Saved filter pills — load on page init
@@ -1006,9 +1006,7 @@ document.addEventListener('DOMContentLoaded', function () {
        shown.forEach(function (w) {
            var words = (w.display_name || '').trim().split(/\s+/).filter(Boolean);
            var initials = words.slice(0, 2).map(function (x) { return x[0].toUpperCase(); }).join('');
-            var hash = 0;
-            for (var i = 0; i < (w.display_name || '').length; i++) hash = ((hash << 5) - hash + (w.display_name || '').charCodeAt(i)) | 0;
-            var color = avatarColors[Math.abs(hash) % 4];
+            var color = avatarColors[crc32(w.display_name || '') % 4];
            html += '<div class="lt-avatar lt-avatar--xs ' + color + '" title="' + lt.escHtml(w.display_name) + '" aria-label="' + lt.escHtml(w.display_name) + '">' +
                    '<img src="/api/user_avatar.php?user_id=' + w.user_id + '" alt="" class="lt-avatar-img">' +
                    '<span class="lt-avatar-initials">' + lt.escHtml(initials) + '</span>' +
@@ -1252,13 +1250,9 @@ document.addEventListener('DOMContentLoaded', function () {
        var words    = displayName.trim().split(/\s+/).filter(Boolean);
        var initials = words.slice(0, 2).map(function (w) { return w[0].toUpperCase(); }).join('');

-        // Avatar color (same modulo logic as PHP: crc32 mod 4)
+        // Avatar color (real crc32, matching PHP's crc32 % 4 exactly)
        var avatarColors = ['lt-avatar--orange', 'lt-avatar--green', 'lt-avatar--purple', ''];
-        var hash = 0;
-        for (var i = 0; i < displayName.length; i++) {
-            hash = ((hash << 5) - hash + displayName.charCodeAt(i)) | 0;
-        }
-        var avatarColor = avatarColors[Math.abs(hash) % 4];
+        var avatarColor = avatarColors[crc32(displayName) % 4];

        // Format date
        var dateStr = c.created_at || '';
@@ -235,11 +235,12 @@
      }

      function loadNotifications() {
-        fetch('/api/notifications.php', { credentials: 'same-origin' })
+        return fetch('/api/notifications.php', { credentials: 'same-origin' })
          .then(function(r) { return r.json(); })
-          .then(renderNotifications)
+          .then(function(data) { renderNotifications(data); return true; })
          .catch(function() {
            list.innerHTML = '<div style="padding:0.75rem;font-size:0.75rem;color:var(--text-muted);text-align:center">Could not load</div>';
+            return false;
          });
      }

@@ -261,9 +262,34 @@
      document.addEventListener('click', function(e) { if (_open && wrapEl && !wrapEl.contains(e.target)) closePanel(); });
      document.addEventListener('keydown', function(e) { if (e.key === 'Escape' && _open) closePanel(); });

-      // Initial badge count + poll every 60s
+      // Poll every 60s while the tab is visible, backing off (up to 5 min) on
+      // repeated failures, and resuming immediately when the tab regains focus.
+      var POLL_INTERVAL = 60000;
+      var MAX_POLL_INTERVAL = 300000;
+      var _pollTimer = null;
+      var _failCount = 0;
+
+      function scheduleNextPoll(delay) {
+        clearTimeout(_pollTimer);
+        _pollTimer = setTimeout(pollNotifications, delay);
+      }
+
+      function pollNotifications() {
+        if (document.hidden) return;
+        loadNotifications().then(function(ok) {
+          _failCount = ok ? 0 : _failCount + 1;
+          var delay = ok ? POLL_INTERVAL : Math.min(POLL_INTERVAL * Math.pow(2, _failCount), MAX_POLL_INTERVAL);
+          scheduleNextPoll(delay);
+        });
+      }
+
+      document.addEventListener('visibilitychange', function() {
+        if (!document.hidden) pollNotifications();
+      });
+
+      // Initial badge count, then start the poll cycle
      loadNotifications();
-      setInterval(loadNotifications, 60000);
+      scheduleNextPoll(POLL_INTERVAL);
    })();
 <?php endif ?>