Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details #87

New Issue

2026-09-01T00:08:18-04:00

jared commented

2026-09-01 00:08:18 -04:00

Severity: Medium

AuditLogModel::getTicketTimeline() requires, for entity_type='comment' rows, that JSON_EXTRACT(details, '$.ticket_id') match the ticket being viewed. logCommentCreate() and the delete-comment audit log call (api/delete_comment.php) both correctly include ticket_id in details. But api/update_comment.php's log call only sets ['comment_text_preview' => ...] — no ticket_id.

Impact: The audit row is written fine (so it shows up in the admin's global Audit Log browser, filterable by entity_type=comment), but getTicketTimeline()'s join condition never matches it, so a comment edit is silently invisible in the ticket page's own timeline — a real accountability gap. A user can edit a comment's content and the ticket's own history shows no trace, while deleting the same comment WOULD be visible on the timeline.

Fix: Add 'ticket_id' => $comment['ticket_id'] to the details array in update_comment.php's audit log call — the endpoint already loads $comment earlier in the file for the access check, so ticket_id is already available at that point.

**Severity:** Medium `AuditLogModel::getTicketTimeline()` requires, for `entity_type='comment'` rows, that `JSON_EXTRACT(details, '$.ticket_id')` match the ticket being viewed. `logCommentCreate()` and the delete-comment audit log call (`api/delete_comment.php`) both correctly include `ticket_id` in `details`. But `api/update_comment.php`'s log call only sets `['comment_text_preview' => ...]` — **no `ticket_id`**. **Impact:** The audit row is written fine (so it shows up in the admin's global Audit Log browser, filterable by `entity_type=comment`), but `getTicketTimeline()`'s join condition never matches it, so a comment edit is silently invisible in the ticket page's own timeline — a real accountability gap. A user can edit a comment's content and the ticket's own history shows no trace, while deleting the same comment WOULD be visible on the timeline. **Fix:** Add `'ticket_id' => $comment['ticket_id']` to the details array in `update_comment.php`'s audit log call — the endpoint already loads `$comment` earlier in the file for the access check, so `ticket_id` is already available at that point.

jared added the priority/medium reliability labels 2026-09-08 10:15:49 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#87