LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix API correctness: external API stub/collision, recurring dates, CSV, audit

Browse Source 
- create_ticket_api.php: remove the wrong CREATE TABLE stub that broke a
  fresh DB; generate collision-safe ticket_ids so a genuine id collision
  isn't misreported as a duplicate and a hw alert dropped; stop leaking
  raw DB errors; correct a reopen comment that falsely claimed refreshed
  sensor data
- manage_recurring.php: fix next-run so create/edit no longer skips the
  current period (monthly day-of-month this month, daily today if time
  not passed, correct ISO weekday, month-length clamp); only recompute
  on schedule changes to avoid double-fire
- export_tickets.php, audit_log.php: neutralize CSV formula injection
- revoke_api_key.php, generate_api_key.php: correct HTTP status codes and
  stop the catch clobbering specific 4xx codes
- health.php: stop leaking PHP version / extension names / paths to
  unauthenticated callers
- watch_ticket.php: define $data before use
- manage_templates/recurring/custom_fields: add audit logging for CRUD;
  add recurring_ticket + custom_field to the audit entity whitelist

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
jared
2026-07-10 12:26:39 -04:00
co-authored by Claude Opus 4.8
parent 327c225ded
commit d11cb989bf
11 changed files with 322 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/custom_fields.php
+25
View File
@@ -15,6 +15,7 @@ try {
require_once dirname(__DIR__) . '/config/config.php';
require_once dirname(__DIR__) . '/helpers/Database.php';
require_once dirname(__DIR__) . '/models/CustomFieldModel.php';
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
// Check authentication
if (session_status() === PHP_SESSION_NONE) {
@@ -50,6 +51,8 @@ try {
header('Content-Type: application/json');
$model = new CustomFieldModel($conn);
$auditLog = new AuditLogModel($conn);
$currentUserId = $_SESSION['user']['user_id'];
$method = $_SERVER['REQUEST_METHOD'];
$id = isset($_GET['id']) ? (int)$_GET['id'] : null;
$category = isset($_GET['category']) ? $_GET['category'] : null;
@@ -75,6 +78,13 @@ try {
exit;
}
$result = $model->createDefinition($data);
if (!empty($result['success'])) {
$auditLog->log($currentUserId, 'create', 'custom_field', (string)($result['field_id'] ?? ''), [
'field_name' => $data['field_name'] ?? null,
'field_label' => $data['field_label'] ?? null,
'field_type' => $data['field_type'] ?? null
]);
}
echo json_encode($result);
break;
@@ -92,6 +102,14 @@ try {
exit;
}
$result = $model->updateDefinition($id, $data);
if (!empty($result['success'])) {
$auditLog->log($currentUserId, 'update', 'custom_field', (string)$id, [
'entity' => 'custom_field',
'field_name' => $data['field_name'] ?? null,
'field_label' => $data['field_label'] ?? null,
'field_type' => $data['field_type'] ?? null
]);
}
echo json_encode($result);
break;
@@ -102,7 +120,14 @@ try {
exit;
}
$toDelete = $model->getDefinition($id);
$result = $model->deleteDefinition($id);
if (!empty($result['success'])) {
$auditLog->log($currentUserId, 'delete', 'custom_field', (string)$id, [
'entity' => 'custom_field',
'field_name' => $toDelete['field_name'] ?? 'unknown'
]);
}
echo json_encode($result);
break;