4 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	882ab2662c	Fix data-layer bugs: bind_param fatals, ticket_id bindings, cache poisoning ... - CustomFieldModel: assign ?? fallbacks to variables before bind_param (by-reference args cannot be ?? expressions; fatal on PHP 8.2, custom fields were uncreatable/uneditable) - RecurringTicketModel::create: fix swapped bind type for schedule_type (enum bound as int coerced 'daily' to 0, breaking the cron) - TicketModel/CommentModel: bind varchar ticket_id as string not int so the unique index is usable and leading-zero IDs match; ticket_watchers (int column) left as integer - TicketModel::deleteTicket: delete from custom_field_values (real table) not the nonexistent ticket_custom_fields - TicketModel search: honor literal '0'; never emit AGAINST('*') on all-special-char input (fall back to LIKE) - TicketModel::updateTicket: disambiguate not-found vs no-op vs genuine optimistic-lock conflict on zero affected rows - WorkflowModel: do not cache transitions/statuses on DB failure (a transient error no longer blocks all status changes for the TTL) - DependencyModel: filter linked tickets by visibility (new optional user context params) to stop confidential metadata leaking via dependencies - BulkOperationsModel: validate status/priority/assignee before mutating - AuditLogModel: gate getClientIP forwarded headers on trusted proxies; add missing action/entity types so audit-log filters work - WorkflowModel: add transitionRequiresComment() accessor for enforcement - CommentModel: stop leaking raw DB errors to clients (log instead) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 10:56:52 -04:00
jared	c90bdc8ac8	style: auto-fix 1340 phpcs PSR-12 violations via phpcbf; exclude MissingNamespace and SideEffects	2026-04-13 20:56:10 -04:00
jaredandClaude Sonnet 4.6	f983269f93	Fix file upload security, bind_param mismatch, and cookie flags ... - upload_attachment.php: derive stored file extension from validated MIME type instead of user-supplied filename, preventing executable extension attacks (e.g. a PHP file renamed to evil.txt would now be stored as .txt) - CustomFieldModel.php: fix bind_param type string in updateDefinition() 'sssssiiiii' (10 chars) → 'sssssiiii' (9 chars) to match 9 SQL placeholders - RateLimitMiddleware.php: replace MD5 with SHA256 for rate limit file hashing - user_preferences.php: add httponly, secure, samesite=Lax flags to ticketsPerPage cookie to prevent XSS/CSRF cookie theft Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-29 18:14:18 -04:00
jaredandClaude Opus 4.5	be505b7312	Implement comprehensive improvement plan (Phases 1-6) ... Security (Phase 1-2): - Add SecurityHeadersMiddleware with CSP, X-Frame-Options, etc. - Add RateLimitMiddleware for API rate limiting - Add security event logging to AuditLogModel - Add ResponseHelper for standardized API responses - Update config.php with security constants Database (Phase 3): - Add migration 014 for additional indexes - Add migration 015 for ticket dependencies - Add migration 016 for ticket attachments - Add migration 017 for recurring tickets - Add migration 018 for custom fields Features (Phase 4-5): - Add ticket dependencies with DependencyModel and API - Add duplicate detection with check_duplicates API - Add file attachments with AttachmentModel and upload/download APIs - Add @mentions with autocomplete and highlighting - Add quick actions on dashboard rows Collaboration (Phase 5): - Add mention extraction in CommentModel - Add mention autocomplete dropdown in ticket.js - Add mention highlighting CSS styles Admin & Export (Phase 6): - Add StatsModel for dashboard widgets - Add dashboard stats cards (open, critical, unassigned, etc.) - Add CSV/JSON export via export_tickets API - Add rich text editor toolbar in markdown.js - Add RecurringTicketModel with cron job - Add CustomFieldModel for per-category fields - Add admin views: RecurringTickets, CustomFields, Workflow, Templates, AuditLog, UserActivity - Add admin APIs: manage_workflows, manage_templates, manage_recurring, custom_fields, get_users - Add admin routes in index.php Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-20 09:55:01 -05:00