Jared Vititoe
bcc163bc77
Security: - Fix IDOR in delete/update comment (add ticket visibility check) - XSS defense-in-depth in DashboardView active filters - Replace innerHTML with DOM construction in toast.js - Remove redundant real_escape_string in check_duplicates - Add rate limiting to get_template, download_attachment, audit_log, saved_filters, user_preferences endpoints Bug fixes: - Session timeout now reads from config instead of hardcoded 18000 - TicketController uses $GLOBALS['config'] instead of duplicate .env parsing - Add DISCORD_WEBHOOK_URL to centralized config - Cleanup script uses hashmap for O(1) ticket ID lookups Dead code removal (~100 lines): - Remove dead getTicketComments() from TicketModel (wrong bind_param type) - Remove dead getCategories()/getTypes() from DashboardController - Remove ~80 lines dead Discord webhook code from update_ticket API Consolidation: - Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit) - Convert 6 API endpoints to use bootstrap - Extract escapeHtml/getTicketIdFromUrl into shared utils.js - Batch save for user preferences (1 request instead of 7) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
112 lines
3.5 KiB
PHP
112 lines
3.5 KiB
PHP
<?php
|
|
/**
|
|
* User Preferences API Endpoint
|
|
* Handles GET (fetch preferences) and POST (update preference)
|
|
*/
|
|
|
|
require_once __DIR__ . '/bootstrap.php';
|
|
require_once dirname(__DIR__) . '/models/UserPreferencesModel.php';
|
|
|
|
$prefsModel = new UserPreferencesModel($conn);
|
|
|
|
// GET - Fetch all preferences for user
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
|
|
try {
|
|
$prefs = $prefsModel->getUserPreferences($userId);
|
|
echo json_encode(['success' => true, 'preferences' => $prefs]);
|
|
} catch (Exception $e) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to fetch preferences']);
|
|
}
|
|
exit;
|
|
}
|
|
|
|
// POST - Update preference(s)
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
|
|
// Validate preference key (whitelist)
|
|
$validKeys = [
|
|
'rows_per_page',
|
|
'default_status_filters',
|
|
'table_density',
|
|
'notifications_enabled',
|
|
'sound_effects',
|
|
'toast_duration'
|
|
];
|
|
|
|
// Support batch save: { preferences: { key: value, ... } }
|
|
if (isset($data['preferences']) && is_array($data['preferences'])) {
|
|
try {
|
|
foreach ($data['preferences'] as $key => $value) {
|
|
$key = trim($key);
|
|
if (!in_array($key, $validKeys)) continue;
|
|
$prefsModel->setPreference($userId, $key, $value);
|
|
if ($key === 'rows_per_page') {
|
|
setcookie('ticketsPerPage', $value, time() + (86400 * 365), '/');
|
|
}
|
|
}
|
|
echo json_encode(['success' => true]);
|
|
} catch (Exception $e) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to save preferences']);
|
|
}
|
|
exit;
|
|
}
|
|
|
|
// Single preference: { key, value }
|
|
if (!isset($data['key']) || !isset($data['value'])) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Missing key or value']);
|
|
exit;
|
|
}
|
|
|
|
$key = trim($data['key']);
|
|
$value = $data['value'];
|
|
|
|
if (!in_array($key, $validKeys)) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid preference key']);
|
|
exit;
|
|
}
|
|
|
|
try {
|
|
$success = $prefsModel->setPreference($userId, $key, $value);
|
|
|
|
// Also update cookie for rows_per_page for backwards compatibility
|
|
if ($key === 'rows_per_page') {
|
|
setcookie('ticketsPerPage', $value, time() + (86400 * 365), '/');
|
|
}
|
|
|
|
echo json_encode(['success' => $success]);
|
|
} catch (Exception $e) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to save preference']);
|
|
}
|
|
exit;
|
|
}
|
|
|
|
// DELETE - Delete a preference (optional endpoint)
|
|
if ($_SERVER['REQUEST_METHOD'] === 'DELETE') {
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
|
|
if (!isset($data['key'])) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Missing key']);
|
|
exit;
|
|
}
|
|
|
|
try {
|
|
$success = $prefsModel->deletePreference($userId, $data['key']);
|
|
echo json_encode(['success' => $success]);
|
|
} catch (Exception $e) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to delete preference']);
|
|
}
|
|
exit;
|
|
}
|
|
|
|
// Method not allowed
|
|
http_response_code(405);
|
|
echo json_encode(['success' => false, 'error' => 'Method not allowed']);
|