maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

Fixed that every support ticket could be accessed by every customer and admin, fixes #1037

Browse Source 
Signed-off-by: Andreas Burchert (scarya) <scarya@froxlor.org>
This commit is contained in:
Andreas Burchert (scarya)
2012-02-08 17:54:25 +01:00
parent ac74e7e6a7
commit d589b77ae0
4 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
admin_tickets.php
View File

@@ -32,6 +32,19 @@ if(isset($_POST['id']))
elseif(isset($_GET['id']))
{
$id = intval($_GET['id']);
if (!$userinfo['customers_see_all']) {
/*
* Check if the current user is allowed to see the current ticket.
*/
$sql = "SELECT `id` FROM `panel_tickets` WHERE `id` = '".$id."' AND `adminid` = '".$userinfo['admindid']."'";
$result = $db->query_first($sql);
if ($result == null) {
// no rights to see the requested ticket
standard_error(array('ticketnotaccessible'));
}
}
}
if($page == 'tickets'
@@ -681,7 +694,7 @@ elseif($page == 'archive'
break;
case 3: $ticket['display'] = 'low';
break;
default: $ticket['display'] = 'unknown';
default: $ticket['display'] = 'unknown';
}
$ticket['priority'] = ticket::getPriorityText($lng, $ticket['priority']);