Jared Vititoe
27075a62ee
CSS fixes: - Fix [ ] brackets appearing below button text by replacing display:inline-flex with display:inline-block + white-space:nowrap on .btn — removes cross-browser flex pseudo-element inconsistency as root cause - Remove conflicting .btn::before ripple block (position:absolute was overriding bracket content positioning) - Remove overflow:hidden from .btn which was clipping bracket content - Fix body::after duplicate rule causing GPU layer blink (second position:fixed rule re-created compositor layer, overriding display:none suppression) - Replace all transition:all with scoped property transitions in dashboard.css, ticket.css, base.css (prevents full CSS property evaluation on every hover) - Convert pulse-warning/pulse-critical keyframes from box-shadow to opacity animation (GPU-composited, eliminates CPU repaints at 60fps) - Fix mobile *::before/*::after blanket content:none rule — now targets only decorative frame glyphs, preserving button brackets and status indicators - Remove --terminal-green-dim override that broke .lt-btn hover backgrounds JS fixes: - Fix all lt.lt.toast.* double-prefix instances in dashboard.js - Add null guard before .appendChild() on bulkAssignUser select - Replace all remaining emoji with terminal bracket notation (dashboard.js, ticket.js, markdown.js) - Migrate all toast.*() shim calls to lt.toast.* across all JS files View fixes: - Remove hardcoded [ ] brackets from .btn buttons (CSS now adds them) - Replace all emoji with terminal bracket notation in all views and admin views - Add missing CSP nonces to AuditLogView.php and UserActivityView.php script tags - Bump CSS version strings to ?v=20260319b for cache busting Security fixes: - update_ticket.php: add authorization check (non-admins can only edit their own or assigned tickets) - add_comment.php: validate and cast ticket_id to integer with 400 response - clone_ticket.php: fix unconditional session_start(), add ticket ID validation, add internal ticket access check - bulk_operation.php: add HTTP 401/403 status codes on auth failures - upload_attachment.php: fix missing $conn arg in AttachmentModel constructor - assign_ticket.php: add ticket existence check and permission verification Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
71 lines
2.2 KiB
PHP
71 lines
2.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/bootstrap.php';
|
|
require_once dirname(__DIR__) . '/models/TicketModel.php';
|
|
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
|
|
require_once dirname(__DIR__) . '/models/UserModel.php';
|
|
|
|
// Get request data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
if (!is_array($data)) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid JSON body']);
|
|
exit;
|
|
}
|
|
|
|
$ticketId = isset($data['ticket_id']) ? (int)$data['ticket_id'] : null;
|
|
$assignedTo = $data['assigned_to'] ?? null;
|
|
|
|
if (!$ticketId) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Ticket ID required']);
|
|
exit;
|
|
}
|
|
|
|
$ticketModel = new TicketModel($conn);
|
|
$auditLogModel = new AuditLogModel($conn);
|
|
$userModel = new UserModel($conn);
|
|
|
|
// Verify ticket exists
|
|
$ticket = $ticketModel->getTicketById($ticketId);
|
|
if (!$ticket) {
|
|
http_response_code(404);
|
|
echo json_encode(['success' => false, 'error' => 'Ticket not found']);
|
|
exit;
|
|
}
|
|
|
|
// Authorization: only admins or the ticket creator/assignee can reassign
|
|
if (!$isAdmin && $ticket['created_by'] !== $userId && $ticket['assigned_to'] !== $userId) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Permission denied']);
|
|
exit;
|
|
}
|
|
|
|
if ($assignedTo === null || $assignedTo === '') {
|
|
// Unassign ticket
|
|
$success = $ticketModel->unassignTicket($ticketId, $userId);
|
|
if ($success) {
|
|
$auditLogModel->log($userId, 'unassign', 'ticket', $ticketId);
|
|
}
|
|
} else {
|
|
// Validate assigned_to is a valid user ID
|
|
$assignedTo = (int)$assignedTo;
|
|
$targetUser = $userModel->getUserById($assignedTo);
|
|
if (!$targetUser) {
|
|
echo json_encode(['success' => false, 'error' => 'Invalid user ID']);
|
|
exit;
|
|
}
|
|
|
|
// Assign ticket
|
|
$success = $ticketModel->assignTicket($ticketId, $assignedTo, $userId);
|
|
if ($success) {
|
|
$auditLogModel->log($userId, 'assign', 'ticket', $ticketId, ['assigned_to' => $assignedTo]);
|
|
}
|
|
}
|
|
|
|
if (!$success) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to update ticket assignment']);
|
|
} else {
|
|
echo json_encode(['success' => true]);
|
|
}
|