Jared Vititoe
89a685a502
Security fixes: - Add HTTP method validation to delete_comment.php (block CSRF via GET) - Remove $_GET fallback in comment deletion (was CSRF bypass vector) - Guard session_start() with session_status() check across API files - Escape json_encode() data attributes with htmlspecialchars in views - Escape inline APP_TIMEZONE config values in DashboardView/TicketView - Validate timezone param against DateTimeZone::listIdentifiers() in index.php - Remove Database::escape() (was using real_escape_string, not safe) - Fix AttachmentModel hardcoded connection; inject via constructor Backend fixes: - Fix CommentModel bind_param type for ticket_id (s→i) - Fix buildCommentThread orphan parent guard - Fix StatsModel JOIN→LEFT JOIN so unassigned tickets aren't excluded - Add ticket ID validation in BulkOperationsModel before implode() - Add duplicate key retry in TicketModel::createTicket() for race conditions - Wrap SavedFiltersModel default filter changes in transactions - Add null result guards in WorkflowModel query methods Frontend JS: - Rewrite toast.js as lt.toast shim (base.js dependency) - Delegate escapeHtml() to lt.escHtml() - Rewrite keyboard-shortcuts.js using lt.keys.on() - Migrate settings.js to lt.api.* and lt.modal.open/close() - Migrate advanced-search.js to lt.api.* and lt.modal.open/close() - Migrate dashboard.js fetch calls to lt.api.*; update all dynamic modals (bulk ops, quick actions, confirm/input) to lt-modal structure - Migrate ticket.js fetchMentionUsers to lt.api.get() - Remove console.log/error/warn calls from JS files Views: - Add /web_template/base.css and base.js to all 10 view files - Call lt.keys.initDefaults() in DashboardView, TicketView, admin views - Migrate all modal HTML from settings-modal/settings-content to lt-modal-overlay/lt-modal/lt-modal-header/lt-modal-body/lt-modal-footer - Replace style="display:none" with aria-hidden="true" on all modals - Replace modal open/close style.display with lt.modal.open/close() - Update modal buttons to lt-btn lt-btn-primary/lt-btn-ghost classes - Remove manual ESC keydown handlers (replaced by lt.keys.initDefaults) - Fix unescaped timezone values in TicketView inline script Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
23 lines
846 B
JavaScript
23 lines
846 B
JavaScript
/**
|
|
* Deprecated: use lt.toast.* directly (from web_template/base.js).
|
|
* This shim maintains backwards compatibility while callers are migrated.
|
|
*/
|
|
|
|
// showToast() shim — used by inline view scripts
|
|
function showToast(message, type = 'info', duration = 3500) {
|
|
switch (type) {
|
|
case 'success': lt.toast.success(message, duration); break;
|
|
case 'error': lt.toast.error(message, duration); break;
|
|
case 'warning': lt.toast.warning(message, duration); break;
|
|
default: lt.toast.info(message, duration); break;
|
|
}
|
|
}
|
|
|
|
// window.toast.* shim — used by JS files
|
|
window.toast = {
|
|
success: (msg, dur) => lt.toast.success(msg, dur),
|
|
error: (msg, dur) => lt.toast.error(msg, dur),
|
|
warning: (msg, dur) => lt.toast.warning(msg, dur),
|
|
info: (msg, dur) => lt.toast.info(msg, dur),
|
|
};
|