5 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	c5f7a01e1d	Fix helpers/config: timezone, comment leak, silent misconfig, cache perms ... - Database.php: pin MySQL session time_zone to the configured named zone (mysql.time_zone tables now loaded on the DB) with a fixed-offset fallback, so NOW()/TIMESTAMP and PHP agree regardless of the DB server's SYSTEM tz. Best-effort, never fatals the connection. - NotificationHelper: redact comment-body previews for internal/ confidential tickets in sendCommentNotification and notifyWatchers so they are not leaked to the shared Matrix notify list (new $visibility param; callers wired in the API batch). - config.php: die with a clear error if parse_ini_file fails instead of silently falling back to insecure defaults (empty DB pass / proxies). - CacheHelper: create cache dir 0700 and cache files 0600 so other local users cannot read or poison security-relevant cached data. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 11:17:07 -04:00
jaredandClaude Opus 4.8	9941fd2dfa	Address remaining review items: Synapse caching, cycle detection, cache/ratelimit/kanban ... - SynapseHelper: memoize username->Matrix-ID lookups per-request (incl. negative results) and add an overall time budget to resolveUsernames() plus a 2s connect timeout, so notifying N watchers with a slow/unreachable Synapse can't stall the request for N x 5s. (Chosen over async/queue per maintainer.) - DependencyModel: fix cycle detection treating 'blocks' and 'blocked_by' as the same edge direction. They are inverse relationships (single row each, no mirror row), so the traversal now walks a unified precedence graph (blocks: ticket-> depends_on; blocked_by: depends_on->ticket) and wouldCreateCycle normalizes the new edge's direction. Prevents both false-positive and missed cycles. - CacheHelper: anchor prefix-delete to exact key boundaries (bare prefix or prefix + '_' + md5) so delete('workflow') can't wipe a 'workflow_rules' cache. - RateLimitMiddleware: hold an exclusive flock across the per-IP counter's read-modify-write so concurrent requests can't both read N and write N+1 (undercounting past the limit). Fails open if the file can't be locked. - dashboard.js: kanban status update now uses lt.api.post (per no-raw-fetch convention) and reverts the card AND the optimistic column counts on failure (the old raw-fetch catch left the card moved without reverting). - BulkOperationsModel: document that bulk_status/bulk_close intentionally bypass workflow transition validation (admin override, by design). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 12:55:50 -04:00
jared	c90bdc8ac8	style: auto-fix 1340 phpcs PSR-12 violations via phpcbf; exclude MissingNamespace and SideEffects	2026-04-13 20:56:10 -04:00
jaredandClaude Opus 4.5	37be81b3e2	Add PHP 7.4+ type hints to helpers, models, and middleware ... Added strict typing with parameter types, return types, and property types across all core classes: - helpers: Database, ErrorHandler, CacheHelper - models: TicketModel, UserModel, WorkflowModel, TemplateModel, UserPreferencesModel - middleware: RateLimitMiddleware, CsrfMiddleware, SecurityHeadersMiddleware Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-29 11:04:36 -05:00
jaredandClaude Opus 4.5	d2a8c73e2c	Add caching layer and database helper ... - Add CacheHelper for file-based caching with TTL support - Add Database helper for centralized connection management - Update WorkflowModel to cache status transitions (10 min TTL) - Update UserPreferencesModel to cache user prefs (5 min TTL) - Update manage_workflows.php to clear cache on changes - Update get_users.php to use Database helper (example migration) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-29 10:53:26 -05:00