Bulk-action buttons have no double-submit guard #36

New Issue

2026-08-31T21:29:43-04:00

jared commented

2026-08-31 21:29:43 -04:00

Severity: Medium

assets/js/dashboard.js (~lines 142-165): all 4 bulk-action buttons (close/assign/priority/status) call their performBulk*() handler directly on click with no button-disable/in-flight guard.

Repro: Open the bulk-close modal, double-click "CLOSE TICKETS" quickly → two concurrent POST /api/bulk_operation.php calls fire for the same ticket IDs, each posting the close-reason comment per ticket — duplicate comments/audit-log entries on every affected ticket (and duplicate Matrix notifications), even though the tickets only actually close once.

Fix: Disable the confirm button (and/or set an in-flight flag) immediately on click, re-enabling only on request completion/error.

**Severity:** Medium `assets/js/dashboard.js` (~lines 142-165): all 4 bulk-action buttons (close/assign/priority/status) call their `performBulk*()` handler directly on click with no button-disable/in-flight guard. **Repro:** Open the bulk-close modal, double-click "CLOSE TICKETS" quickly → two concurrent `POST /api/bulk_operation.php` calls fire for the same ticket IDs, each posting the close-reason comment per ticket — duplicate comments/audit-log entries on every affected ticket (and duplicate Matrix notifications), even though the tickets only actually close once. **Fix:** Disable the confirm button (and/or set an in-flight flag) immediately on click, re-enabling only on request completion/error.

jared added the concurrency priority/medium ux labels 2026-09-08 10:15:44 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#36