maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

Fixed that every support ticket could be accessed by every customer and admin, fixes #1037

Browse Source 
Signed-off-by: Andreas Burchert (scarya) <scarya@froxlor.org>
This commit is contained in:
Andreas Burchert (scarya)
2012-02-08 17:54:25 +01:00
parent ac74e7e6a7
commit d589b77ae0
4 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
customer_tickets.php
View File

@@ -28,6 +28,17 @@ require ("./lib/init.php");
if(isset($_POST['id']))
{
$id = intval($_POST['id']);
/*
* Check if the current user is allowed to see the current ticket.
*/
$sql = "SELECT `id` FROM `panel_tickets` WHERE `id` = '".$id."' AND `customerid` = '".$userinfo['customerid']."'";
$result = $db->query_first($sql);
if ($result == null) {
// no rights to see the requested ticket
standard_error(array('ticketnotaccessible'));
}
}
elseif(isset($_GET['id']))
{