From bbeae81b8cb7e6b17a5719d46c6a565dcd907124 Mon Sep 17 00:00:00 2001
From: Peter Rotich <peter@osticket.com>
Date: Thu, 3 Dec 2015 17:59:40 +0000
Subject: [PATCH] Require edit permission to manage forms
---
include/ajax.tickets.php | 15 ++++++++++++---
include/staff/ticket-view.inc.php | 4 ++++
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/include/ajax.tickets.php b/include/ajax.tickets.php
index 95e124a1f..6acae0719 100644
--- a/include/ajax.tickets.php
+++ b/include/ajax.tickets.php
@@ -276,8 +276,17 @@ class TicketsAjaxAPI extends AjaxController {
}
function manageForms($ticket_id) {
- $forms = DynamicFormEntry::forTicket($ticket_id);
- $info = array('action' => '#tickets/'.Format::htmlchars($ticket_id).'/forms/manage');
+ global $thisstaff;
+
+ if (!$thisstaff)
+ Http::response(403, "Login required");
+ elseif (!($ticket = Ticket::lookup($ticket_id)))
+ Http::response(404, "No such ticket");
+ elseif (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_EDIT))
+ Http::response(403, "Access Denied");
+
+ $forms = DynamicFormEntry::forTicket($ticket->getId());
+ $info = array('action' => '#tickets/'.$ticket->getId().'/forms/manage');
include(STAFFINC_DIR . 'templates/form-manage.tmpl.php');
}
@@ -288,7 +297,7 @@ class TicketsAjaxAPI extends AjaxController {
Http::response(403, "Login required");
elseif (!($ticket = Ticket::lookup($ticket_id)))
Http::response(404, "No such ticket");
- elseif (!$ticket->checkStaffPerm($thisstaff))
+ elseif (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_EDIT))
Http::response(403, "Access Denied");
elseif (!isset($_POST['forms']))
Http::response(422, "Send updated forms list");
diff --git a/include/staff/ticket-view.inc.php b/include/staff/ticket-view.inc.php
index 2b39913a5..782151d32 100644
--- a/include/staff/ticket-view.inc.php
+++ b/include/staff/ticket-view.inc.php
@@ -168,11 +168,15 @@ if($ticket->isOverdue())
<?php
}
} ?>
+ <?php
+ if ($role->hasPerm(Ticket::PERM_EDIT)) { ?>
<li><a href="#ajax.php/tickets/<?php echo $ticket->getId();
?>/forms/manage" onclick="javascript:
$.dialog($(this).attr('href').substr(1), 201);
return false"
><i class="icon-paste"></i> <?php echo __('Manage Forms'); ?></a></li>
+ <?php
+ } ?>
<?php if ($thisstaff->hasPerm(Email::PERM_BANLIST)) {
if(!$emailBanned) {?>
--
GitLab