6 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	4164f85051	Fix bugs found in second multi-agent review ... XSS / security: - markdown.js: sanitize footnote labels to a safe slug before using them in id/href attributes. Labels are captured before the HTML-escape pass, so a label like x"><img onerror=...> broke out → stored XSS (the earlier quote- escape fix didn't cover this path). Verified neutralized. - RateLimitMiddleware: only trust X-Forwarded-For / X-Real-IP when REMOTE_ADDR is a configured trusted proxy, and use the rightmost (proxy-appended) entry. Previously any client could rotate XFF to escape the per-IP rate limit. - .env.example: document TRUSTED_PROXIES so fresh deploys aren't fail-open on the Authelia forward-auth spoofing protection. Correctness: - notifications.php: my previous assigned-to LIKE fix anchored only on '}', so BULK assignments (logged {"assigned_to":N,"bulk_operation_id":..}) produced no "assigned to you" notification — now matches both '}' and ',' delimiters. - notifications.php: implement the documented @mention notifications (query action_type='mention' rows for the current user); they were never delivered. - NotificationHelper::notifyWatchers: guard unchecked prepare() so a missing ticket_watchers table can't fatal the request after its DB write committed. - AuditLogModel::getTicketTimeline: JSON_UNQUOTE the extracted ticket_id so comment events actually match (string vs JSON-number comparison never did). - AuditLogModel/audit_log.php: CSV export no longer silently truncates to the 1000-row UI cap; uses a dedicated higher export limit. - DashboardView: quick-preview drawer read .ticket-link from the title cell (which has none), so the title was always blank — use the cell text. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 12:00:36 -04:00
jared	c90bdc8ac8	style: auto-fix 1340 phpcs PSR-12 violations via phpcbf; exclude MissingNamespace and SideEffects	2026-04-13 20:56:10 -04:00
jaredandClaude Sonnet 4.6	b42597c927	Fix CSS variables, missing utility classes, API hardening, and audit log UX ... - base.css: add --lt-border/--lt-surface aliases so dashboard.css respects theme instead of using hardcoded fallback colors - base.css: add lt-select-sm/lt-input-sm compact size variants (used in 15+ places), lt-msg-danger alias for lt-msg-error, lt-form-hint--warn, lt-font-mono utility class - audit_log.php: cap ?limit= at 500 to prevent DoS via oversized queries - ApiKeysView.php: replace deprecated execCommand('copy') with lt.copy(); add integer casts on api_key_id in id attr and data-id - AuditLogView.php: rebuild pagination with windowed prev/next/ellipsis pattern matching DashboardView; integer cast on user_id select option Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 13:22:12 -04:00
jaredandClaude Opus 4.6	bcc163bc77	Audit fixes: security, dead code removal, API consolidation, JS dedup ... Security: - Fix IDOR in delete/update comment (add ticket visibility check) - XSS defense-in-depth in DashboardView active filters - Replace innerHTML with DOM construction in toast.js - Remove redundant real_escape_string in check_duplicates - Add rate limiting to get_template, download_attachment, audit_log, saved_filters, user_preferences endpoints Bug fixes: - Session timeout now reads from config instead of hardcoded 18000 - TicketController uses $GLOBALS['config'] instead of duplicate .env parsing - Add DISCORD_WEBHOOK_URL to centralized config - Cleanup script uses hashmap for O(1) ticket ID lookups Dead code removal (~100 lines): - Remove dead getTicketComments() from TicketModel (wrong bind_param type) - Remove dead getCategories()/getTypes() from DashboardController - Remove ~80 lines dead Discord webhook code from update_ticket API Consolidation: - Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit) - Convert 6 API endpoints to use bootstrap - Extract escapeHtml/getTicketIdFromUrl into shared utils.js - Batch save for user preferences (1 request instead of 7) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-11 14:50:06 -05:00
jaredandClaude Opus 4.5	7575d6a277	Add performance, security, and reliability improvements ... - Consolidate all 20 API files to use centralized Database helper - Add optimistic locking to ticket updates to prevent concurrent conflicts - Add caching to StatsModel (60s TTL) for dashboard performance - Add health check endpoint (api/health.php) for monitoring - Improve rate limit cleanup with cron script and efficient DirectoryIterator - Enable rate limit response headers (X-RateLimit-*) - Add audit logging for workflow transitions - Log Discord webhook failures instead of silencing - Fix visibility check on export_tickets.php - Add database migration system with performance indexes - Fix cron recurring tickets to use assignTicket method Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-30 14:39:13 -05:00
jared	962724d811	better filtering and searching	2026-01-09 11:20:27 -05:00