Jared Vititoe
bcc163bc77
Security: - Fix IDOR in delete/update comment (add ticket visibility check) - XSS defense-in-depth in DashboardView active filters - Replace innerHTML with DOM construction in toast.js - Remove redundant real_escape_string in check_duplicates - Add rate limiting to get_template, download_attachment, audit_log, saved_filters, user_preferences endpoints Bug fixes: - Session timeout now reads from config instead of hardcoded 18000 - TicketController uses $GLOBALS['config'] instead of duplicate .env parsing - Add DISCORD_WEBHOOK_URL to centralized config - Cleanup script uses hashmap for O(1) ticket ID lookups Dead code removal (~100 lines): - Remove dead getTicketComments() from TicketModel (wrong bind_param type) - Remove dead getCategories()/getTypes() from DashboardController - Remove ~80 lines dead Discord webhook code from update_ticket API Consolidation: - Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit) - Convert 6 API endpoints to use bootstrap - Extract escapeHtml/getTicketIdFromUrl into shared utils.js - Batch save for user preferences (1 request instead of 7) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
33 lines
875 B
PHP
33 lines
875 B
PHP
<?php
|
|
/**
|
|
* Get Users API
|
|
* Returns list of users for @mentions autocomplete
|
|
*/
|
|
|
|
require_once __DIR__ . '/bootstrap.php';
|
|
|
|
try {
|
|
// Get all users for mentions/assignment
|
|
$result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username");
|
|
|
|
if (!$result) {
|
|
throw new Exception("Failed to query users");
|
|
}
|
|
|
|
$users = [];
|
|
while ($row = $result->fetch_assoc()) {
|
|
$users[] = [
|
|
'user_id' => $row['user_id'],
|
|
'username' => $row['username'],
|
|
'display_name' => $row['display_name']
|
|
];
|
|
}
|
|
|
|
echo json_encode(['success' => true, 'users' => $users]);
|
|
|
|
} catch (Exception $e) {
|
|
error_log("Get users API error: " . $e->getMessage());
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
|
|
}
|