Issues - tinker_tickets - Lotus Git Server

LotusGuild/tinker_tickets

Labels Milestones New Issue

index.php and create_ticket_api.php use their own raw mysqli connections instead of Database::getConnection() — missing charset/timezone sync on most page traffic data-integrity priority/high

opened 2026-09-01 00:21:11 -04:00 by jared

TRUSTED_PROXIES ships empty/disabled by default — full admin-impersonation risk if not explicitly configured config priority/high security

opened 2026-09-01 00:13:36 -04:00 by jared

12 of ~16 hand-rolled CSRF checks omit csrf_token from their rejection response, breaking client-side resync app-wide priority/high security

opened 2026-09-01 00:08:16 -04:00 by jared

Bearer read-scope API keys bypass ticket visibility entirely — confirm this is an intentional, documented decision needs-decision priority/high security

opened 2026-09-01 00:07:09 -04:00 by jared

@mention notifications leak confidential/internal ticket content to users with no access — worse than #46 notifications priority/high security

opened 2026-09-01 00:07:08 -04:00 by jared

hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL priority/high security workflow

opened 2026-09-01 00:07:08 -04:00 by jared

Bulk operations never fire Matrix/watcher notifications for status changes notifications priority/high

opened 2026-09-01 00:07:07 -04:00 by jared

Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h) priority/high security

opened 2026-08-31 21:40:09 -04:00 by jared

Custom Fields feature is entirely disconnected from ticket creation/editing/viewing priority/high ux

opened 2026-08-31 21:36:16 -04:00 by jared

Confidential/internal ticket titles leak to Matrix on create/status-change (NotificationHelper missing visibility check) notifications priority/high security

opened 2026-08-31 21:36:16 -04:00 by jared