6 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	d6214a0339	Add schema baseline, fix cron/retention, restore cleanup, correct docs ... - migrations/000_baseline.sql: full schema baseline captured from prod (validated on a throwaway DB: 17 tables/17 FKs), so the schema is reproducible for fresh installs / disaster recovery - create_recurring_tickets cron: send the Matrix ticket-created notification and invalidate the stats cache like the other create paths - create_ticket_api.php + TicketController::create: invalidate the stats cache on create/escalate/reopen so dashboard counts aren't stale - scripts/cleanup_orphan_uploads.php: restored, made safe (24h mtime grace, 9-digit-dir only, skips avatars/symlinks, matches the unique filename column, --dry-run) - cron/cleanup_audit_log.php: enforce the configured audit-log retention (deleteOldLogs was implemented but never called) - README: correct CSRF-rotation, hwmon dedup (no 24h window), SLA (no P3), stats-cache callers, and the project structure/endpoint listing - .env.example: document TRUSTED_PROXIES fail-open risk and .env quoting Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 16:11:26 -04:00
jaredandClaude Opus 4.8	4164f85051	Fix bugs found in second multi-agent review ... XSS / security: - markdown.js: sanitize footnote labels to a safe slug before using them in id/href attributes. Labels are captured before the HTML-escape pass, so a label like x"><img onerror=...> broke out → stored XSS (the earlier quote- escape fix didn't cover this path). Verified neutralized. - RateLimitMiddleware: only trust X-Forwarded-For / X-Real-IP when REMOTE_ADDR is a configured trusted proxy, and use the rightmost (proxy-appended) entry. Previously any client could rotate XFF to escape the per-IP rate limit. - .env.example: document TRUSTED_PROXIES so fresh deploys aren't fail-open on the Authelia forward-auth spoofing protection. Correctness: - notifications.php: my previous assigned-to LIKE fix anchored only on '}', so BULK assignments (logged {"assigned_to":N,"bulk_operation_id":..}) produced no "assigned to you" notification — now matches both '}' and ',' delimiters. - notifications.php: implement the documented @mention notifications (query action_type='mention' rows for the current user); they were never delivered. - NotificationHelper::notifyWatchers: guard unchecked prepare() so a missing ticket_watchers table can't fatal the request after its DB write committed. - AuditLogModel::getTicketTimeline: JSON_UNQUOTE the extracted ticket_id so comment events actually match (string vs JSON-number comparison never did). - AuditLogModel/audit_log.php: CSV export no longer silently truncates to the 1000-row UI cap; uses a dedicated higher export limit. - DashboardView: quick-preview drawer read .ticket-link from the title cell (which has none), so the title was always blank — use the cell text. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 12:00:36 -04:00
jaredandClaude Sonnet 4.6	18bf1fde0e	feat: LDAP avatar support via lldap ... - Create tinker-tickets service account in lldap (lldap_strict_readonly) - Add /api/user_avatar.php: binds to lldap, fetches avatar attribute, caches JPEG to uploads/avatars/, returns 404 sentinel for missing photos - Install php8.2-ldap on LXC 132 (beta) and LXC coding server - Update layout_header.php: show lt-avatar with photo overlay + initials fallback - Update TicketView.php: comment avatars use photo overlay pattern - Add .lt-avatar-img / .lt-avatar-initials CSS for photo-over-initials layout - Add LDAP_* config keys to config.php and .env.example Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 20:47:08 -04:00
jaredandClaude Sonnet 4.6	f59913910f	Replace Discord webhook notifications with Matrix (hookshot) ... - Add helpers/NotificationHelper.php: shared Matrix webhook sender that reads MATRIX_WEBHOOK_URL and MATRIX_NOTIFY_USERS from config - Remove sendDiscordWebhook() from TicketController; call NotificationHelper::sendTicketNotification() instead - Replace 60-line Discord embed block in create_ticket_api.php with a single NotificationHelper call - config/config.php: DISCORD_WEBHOOK_URL → MATRIX_WEBHOOK_URL + new MATRIX_NOTIFY_USERS key (comma-separated Matrix user IDs) - .env.example: updated env var names and comments Payload sent to hookshot includes notify_users array so the JS transform can build proper @mention links for each user. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-02-21 19:17:46 -05:00
jaredandClaude Opus 4.5	019eaf8980	Add assignment dropdown on ticket creation and fix Discord webhook URLs ... - Add APP_DOMAIN config for correct Discord webhook ticket links - Add "Assign To" dropdown on create ticket form - Update TicketModel.createTicket() to support assigned_to field - Update documentation for APP_DOMAIN requirement Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-05 10:24:00 -05:00
jaredandClaude Opus 4.5	6d03f9c89b	fix: Session auth, sidebar toggle, and dependencies table ... - Change session.cookie_samesite from Strict to Lax for Authelia compatibility - Redesign sidebar toggle with separate collapse/expand buttons - Add script to create missing ticket_dependencies table - Add .env.example template - Add check for missing .env with helpful error message Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-23 21:16:29 -05:00