Issues - tinker_tickets - Lotus Git Server

LotusGuild/tinker_tickets

Labels Milestones New Issue

Ticket pages are giving a 500, maybe due to the mcp server deployment? bug priority/high

by jared was closed 2026-09-25 15:54:02 -04:00

index.php and create_ticket_api.php use their own raw mysqli connections instead of Database::getConnection() — missing charset/timezone sync on most page traffic data-integrity priority/high

by jared was closed 2026-09-11 11:54:45 -04:00

Dashboard 'Quick Assign' is completely non-functional — wrong callback contract priority/high ux

by jared was closed 2026-09-08 20:46:44 -04:00

TRUSTED_PROXIES ships empty/disabled by default — full admin-impersonation risk if not explicitly configured config priority/high security

by jared was closed 2026-09-11 11:54:45 -04:00

12 of ~16 hand-rolled CSRF checks omit csrf_token from their rejection response, breaking client-side resync app-wide priority/high security

by jared was closed 2026-09-11 11:54:45 -04:00

In-app notification title formatter assumes every ticket update is a status change — breaks for title/priority/description/category/type/visibility edits notifications priority/high

by jared was closed 2026-09-08 20:46:41 -04:00

Bearer read-scope API keys bypass ticket visibility entirely — confirm this is an intentional, documented decision needs-decision priority/high security

by jared was closed 2026-09-12 01:21:14 -04:00

@mention notifications leak confidential/internal ticket content to users with no access — worse than #46 notifications priority/high security

by jared was closed 2026-09-11 11:27:07 -04:00

hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL priority/high security workflow

by jared was closed 2026-09-11 12:44:17 -04:00

Bulk operations never fire Matrix/watcher notifications for status changes notifications priority/high

by jared was closed 2026-09-11 12:44:16 -04:00

Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h) priority/high security

by jared was closed 2026-09-11 12:24:00 -04:00

Custom Fields feature is entirely disconnected from ticket creation/editing/viewing priority/high ux

by jared was closed 2026-09-11 13:17:43 -04:00

Confidential/internal ticket titles leak to Matrix on create/status-change (NotificationHelper missing visibility check) notifications priority/high security

by jared was closed 2026-09-11 11:27:06 -04:00

ticket_watchers: ticket_id type mismatch (int vs varchar) and missing FK to tickets data-integrity priority/high

by jared was closed 2026-09-08 21:33:43 -04:00

Avatar color hash has drifted between PHP (crc32) and JS (custom hash) — same user shows different colors priority/high ux

by jared was closed 2026-09-08 20:46:35 -04:00

migrate.php: transaction wrapping around DDL is illusory, failed migration can wedge the runner data-integrity priority/high reliability

by jared was closed 2026-09-08 21:33:42 -04:00

Dashboard chart click-to-filter discards other active filters priority/high ux

by jared was closed 2026-09-08 20:46:35 -04:00

TicketModel: visibility-filter group matching disagrees with single-ticket access check data-integrity priority/high security

by jared was closed 2026-09-08 21:33:42 -04:00

create_ticket_api.php: no rate limiting on external Bearer-key endpoint api priority/high rate-limiting security

by jared was closed 2026-09-08 21:33:42 -04:00