Issues - tinker_tickets - Lotus Git Server

LotusGuild/tinker_tickets

Labels Milestones New Issue

App has no styled 500/fatal-error page — ErrorHandler is wired into essentially nothing priority/medium reliability

opened 2026-09-01 00:21:13 -04:00 by jared

DB connection failure leaks raw mysqli error text to any unauthenticated visitor priority/medium security

opened 2026-09-01 00:21:12 -04:00 by jared

Attachment 'thumbnails' are the full-size original image — no actual resized thumbnail is ever generated performance priority/medium

opened 2026-09-01 00:13:38 -04:00 by jared

LDAP bind credentials transmitted in plaintext (no TLS) priority/medium security

opened 2026-09-01 00:13:37 -04:00 by jared

Recurring ticket: a creation failure after claiming a schedule silently and permanently loses that occurrence priority/medium reliability

opened 2026-09-01 00:08:18 -04:00 by jared

Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details priority/medium reliability

opened 2026-09-01 00:08:18 -04:00 by jared

CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first priority/medium ux

opened 2026-09-01 00:08:17 -04:00 by jared

Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another priority/medium rate-limiting security

opened 2026-09-01 00:07:14 -04:00 by jared

RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect config priority/medium rate-limiting

opened 2026-09-01 00:07:14 -04:00 by jared

Matrix webhook calls are synchronous with no connect-timeout — worst case ~30s added to a single comment's response time notifications performance priority/medium

opened 2026-09-01 00:07:12 -04:00 by jared

Bulk-operation audit_log entries use a different shape than every other status-change path, breaking the timeline and in-app notifications data-integrity notifications priority/medium

opened 2026-09-01 00:07:11 -04:00 by jared

Watchers are never pruned when a ticket's visibility is tightened notifications priority/medium security

opened 2026-09-01 00:07:10 -04:00 by jared

sendAssignmentNotification() has the same missing-visibility-check gap as #46 notifications priority/medium security

opened 2026-09-01 00:07:10 -04:00 by jared

notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak notifications priority/medium security

opened 2026-09-01 00:07:09 -04:00 by jared

Workflow Designer allows duplicate transition rows that silently override each other non-deterministically data-integrity priority/medium workflow

opened 2026-08-31 23:57:36 -04:00 by jared

Advanced Search silently drops filters it doesn't represent, on submit priority/medium ux

opened 2026-08-31 21:40:10 -04:00 by jared

Notification bell uses raw fetch() instead of lt.api, breaking CSRF token resync priority/medium ux

opened 2026-08-31 21:40:10 -04:00 by jared

Custom field values have no server-side validation against field_type or select options priority/medium security

opened 2026-08-31 21:36:18 -04:00 by jared

User Activity report: "Tickets Assigned" column filters by ticket creation date, not assignment date priority/medium reliability

opened 2026-08-31 21:36:17 -04:00 by jared

api/notifications.php: in-app notifications don't re-check current ticket visibility notifications priority/medium security

opened 2026-08-31 21:36:17 -04:00 by jared

1 2